student_management_system CVE-2026-11533

Exploitation requires a valid authenticated session with at least low-level privileges on the student management system (PR:L per CVSS 4.0 vector); unauthenticated external attackers cannot exploit this directly. The vulnerable code path is /see.php and is triggered specifically by supplying the del parameter in a request to the Student Deletion Endpoint - the application must be internet- or network-accessible (AV:N) for remote exploitation. No special server configuration beyond a standard deployment is required (AT:N, AC:L). What limits exploitation: the attacker must first possess valid credentials to any account on the system; the impact is constrained to data integrity and availability (no confidentiality exposure); and the application is a niche open-source project unlikely to be deployed at enterprise scale. The absence of any automated exploitation or KEV listing further limits realistic exposure to insider threats or targeted attacks on known deployments.

The CVSS 4.0 base score of 2.1 reflects genuinely limited real-world impact: the vector (AV:N/AC:L/AT:N/PR:L/UI:N) confirms network-accessible exploitation with low complexity and no special attack requirements, but PR:L indicates a low-privileged authenticated account is required - the attacker cannot exploit this without first obtaining valid credentials. The confidentiality impact is None (VC:N/SC:N), meaning no data exfiltration is possible through this vector alone; impact is limited to Integrity:Low and Availability:Low on the vulnerable system, translating to unauthorized deletion of student records. The Exploit Maturity modifier E:P (Proof of Concept) confirms a public PoC exists via the GitHub issue, which elevates the practical accessibility of the exploit. However, this is not listed in CISA KEV, and EPSS data is not provided, so widespread automated exploitation cannot be confirmed. The overall risk profile is low-to-moderate for affected deployments: an insider or compromised low-privilege account could destroy student data, but external unauthenticated attackers are blocked. The discrepancy between the 'Authentication Bypass' tag and the actual CWE-285 classification should be noted - the tag may overstate the severity; available evidence supports an authorization bypass, not a full authentication bypass.

An attacker with any valid low-privileged account in the student management system - such as a student user - sends a crafted HTTP request to /see.php with a manipulated del parameter referencing another student's record ID. Because the endpoint performs no authorization check to verify the caller's privilege level, the deletion is processed server-side and the targeted record is permanently removed. A publicly available proof-of-concept is documented in the GitHub issue at https://github.com/imvks786/student_management_system/issues/4, lowering the technical barrier to exploitation for any authenticated user.