Is there a public PoC exploit available for CVE-2026-11476?

Yes, a public proof-of-concept exploit is available for CVE-2026-11476. Prioritise patching immediately. EPSS: 0.0%.

student-management-system CVE-2026-11476

Q: What is the CVSS score of CVE-2026-11476?

CVE-2026-11476 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-35007 LOW

Improper Authorization (CWE-285)

2026-06-08 VulDB

GHSA-pqhc-c2mx-835p

PHP Authentication Bypass Student Management System

2.1

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 08, 2026 - 02:28 vuln.today

Severity Changed

Jun 08, 2026 - 02:22 NVD

MEDIUM LOW

CVSS changed

Jun 08, 2026 - 02:22 NVD

6.3 (MEDIUM) 2.1 (LOW)

DescriptionCVE.org

A security vulnerability has been detected in Kushan2k student-management-system up to f16a4ceaddd6729c4b306ed4641cda3176c1ef2a. Affected by this issue is the function edit-admin of the file controllers/AdminController.php of the component Profile Update Endpoint. The manipulation of the argument isadmin leads to improper authorization. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. The project was informed of the problem early through an issue report but has not responded yet.

AnalysisAI

Privilege escalation in Kushan2k student-management-system allows authenticated remote attackers to grant themselves administrator rights by manipulating the isadmin parameter in the Profile Update Endpoint. The edit-admin function in controllers/AdminController.php performs no server-side authorization check on this parameter, enabling any low-privileged account holder to self-elevate to admin. A publicly available exploit exists per VulDB and a GitHub issue disclosure; the vendor has not yet responded, and no patch has been released under the rolling-release model.

Technical ContextAI

The affected product is a PHP-based student management system authored by Kushan2k (CPE: cpe:2.3:a:kushan2k:student-management-system:*:*:*:*:*:*:*:*). The root cause is CWE-285 (Improper Authorization): the server-side edit-admin function in controllers/AdminController.php accepts a client-supplied isadmin argument during profile update operations without verifying whether the requesting user is authorized to change their own role. This is a classic mass-assignment or parameter tampering flaw where the application trusts user-controllable input to determine privilege level rather than enforcing role boundaries at the server. The rolling-release model means no discrete version string identifies the fixed state; the vulnerability exists in all code up to commit f16a4ceaddd6729c4b306ed4641cda3176c1ef2a.

RemediationAI

No vendor-released patch has been identified at time of analysis - the maintainer has not responded to disclosure per the CVE description. As an immediate compensating control, administrators should apply a web server or WAF rule to block or sanitize the isadmin parameter in POST requests to the Profile Update Endpoint, preventing clients from supplying this field; note this may interfere with legitimate admin-initiated profile edits and should be tested carefully. Alternatively, the edit-admin function in controllers/AdminController.php can be patched locally to enforce a server-side role check - verify the requesting user's current role from the session rather than accepting isadmin from the request body. Administrators should audit their user database immediately for any accounts with unexpected administrator privileges and revoke them. Monitor the public GitHub issue at https://github.com/Kushan2k/student-management-system/issues/3 and the VulDB entry at https://vuldb.com/vuln/369096 for any vendor response or upstream commit that addresses the flaw.