EUVD-2026-88012
GHSA-3xr8-56j6-mxh4
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach loginlinkstudent.php remotely
-
ExploitSupply victim email in umail argument
-
ExecutionBypass missing authentication check
-
ImpactAccess student-scoped functions/data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication required for critical functions
MITRE ATT&CK
1 technique across 1 tactic: Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires reaching the loginlinkstudent.php endpoint of a deployed CloudClassroom-PHP-Project instance and supplying the target's email via the 'umail' argument; the described flaw is a missing authentication check on that flow, so no valid credentials or user interaction are needed per the description. Limiting factors: the product is an obscure, unversioned hobby project with negligible real-world deployment, and the concrete impact is bounded to student-scoped data/functions rather than administrative or full-system compromise. |
| Impact | This is a genuine but low-priority issue. The CWE-306 (Missing Authentication) flaw in loginlinkstudent.php lets a remote attacker manipulate the 'umail' argument to reach functionality without proper authentication - the linked advisory frames it as broken role segregation / authentication bypass. A public exploit exists (POC=YES via GitHub/rmsbpro), which raises practical concern, but there is no CISA KEV listing and no EPSS score provided, so there is no evidence of active or widespread exploitation. The vendor's CVSS 4.0 vector (5.3) is internally inconsistent with the assigned CWE: it sets PR:L (privileges required), yet a Missing Authentication weakness described as 'missing authentication' implies no privileges are required (PR:N) - this contradiction should be verified against the actual code, since it materially affects scoring. Impact is bounded (VC:L/VI:L/VA:L), consistent with limited access to student-scoped data/functions rather than full compromise. Net: real, exploit-available, but confined to an obscure hobby project - targeted curiosity, not a fleet-wide priority. |
| Exploit ScenarioDerived | A remote attacker submits a crafted request to loginlinkstudent.php supplying only a victim's email in the 'umail' argument, bypassing the missing authentication check to obtain student-context access. Public exploit code exists (referenced advisory 'broken-role-segregation.md'), lowering the skill barrier. Because the app is a rolling-release project with no fix, any deployed instance remains exposed. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 27, 2026
Missing authentication in loginlinkstudent.php of Mathurvishal CloudClassroom-PHP-Project allows remote unauthenticated attackers to bypass login checks by manipulating the umail parameter, potentially gaining access to student-scoped functions and data. The vulnerability (CVE-2026-100876) has a publicly available exploit, but no active exploitation has been confirmed. The independent assessment rates it as a genuine but low-priority issue due to the product's obscure, unversioned hobby-project nature and negligible real-world deployment.
RemediationAI
No vendor-released patch is available; the vendor did not respond to disclosure, and the project's rolling-release model provides no fixed version. Administrators should immediately disable or remove the loginlinkstudent.php endpoint if not required, or enforce authentication via a reverse proxy (e.g., HTTP Basic Auth or SSO) for that path-though this may break legitimate student login flows. Alternatively, modify the code to add an authentication check before processing the umail parameter. Network-level restrictions (e.g., firewall rules blocking external access to the script) can reduce exposure but may not prevent internal abuse. Given the low real-world deployment and limited impact (student-scoped data/functions), discontinuing use of the project is a reasonable trade-off. Monitor the VulDB entry (https://vuldb.com/vuln/410806) for updates.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is a CWE-306 (Missing Authentication for Critical Function) in the loginlinkstudent.php script of the CloudClassroom-PHP-Project. The script appears to handle student login via an email-based link, using the umail parameter to identify the user, but fails to verify that the requester is authenticated or authorized for that action. This allows an attacker to submit an arbitrary email address and gain access to student-specific session or functionality. The CPE cpe:2.3:a:mathurvishal:cloudclassroom-php-project:*:*:*:*:*:*:*:* indicates all versions are affected (rolling release). The vendor-provided CVSS 4.0 vector (CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P) suggests network exploitability with low privileges required, but the independent assessment (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) treats it as unauthenticated, consistent with the described missing authentication check. The public exploit reference is a GitHub advisory titled 'broken-role-segregation.md', indicating a role segregation bypass.
Know when PHP gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
CWE-306 missing authentication described as network-reachable via a single email parameter warrants PR:N/AC:L (not the vendor's PR:L); impact is limited student-scoped access, so C:L/I:L and A:N.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A vulnerability was found in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. Affected is an unknown function of the file loginlinkstudent.php. Performing a manipulation of the argument umail results in missing authentication. Remote exploitation of the attack is possible. The exploit has been made public and could be used. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. The vendor was contacted early about this disclosure but did not respond in any way.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Exploit-DB