stumasy CVE-2026-14753

Q: What is the CVSS score of CVE-2026-14753?

CVE-2026-14753 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-41759 MEDIUM

Improper Authorization (CWE-285)

2026-07-05 cna@vuldb.com

GHSA-v8j5-g875-7qj3

PHP Authentication Bypass

5.5

CVSS 4.0 · Vendor: vuldb

Severity by source

Vendor (vuldb) PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.3 HIGH

Network-exposed endpoint requires no privileges or interaction; low CIA impact scoped to student record data only.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (vuldb).

CVSS VectorVendor: vuldb

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 05, 2026 - 14:35 vuln.today

DescriptionCVE.org

A vulnerability was detected in mjperpinosa stumasy up to 327d1b0f2915ba79d7ef8ebb74553e987609d9be. This impacts an unknown function of the file /PHP/objects/notes of the component Note Handler/Assignment Handler. Performing a manipulation of the argument assignment_item_id results in authorization bypass. The attack can be initiated remotely. The exploit is now public and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet.

AnalysisAI

Authorization bypass in stumasy, a PHP-based student management system, exposes the Note Handler and Assignment Handler endpoints at /PHP/objects/notes to unauthenticated remote exploitation by manipulating the assignment_item_id parameter. The flaw (CWE-285: Improper Authorization) allows an attacker to read, modify, or otherwise interact with notes and assignment records belonging to other users without possessing the required authorization. Public exploit code exists per the CVSS 4.0 E:P threat metric, and the project maintainer has not responded to the disclosure, meaning no patch is available at time of analysis.

Technical ContextAI

stumasy is a PHP web application hosted at github.com/mjperpinosa/stumasy implementing student management functionality including notes and assignment tracking. The vulnerable component is the Note Handler/Assignment Handler exposed via the /PHP/objects/notes endpoint. The root cause is CWE-285 (Improper Authorization): the application fails to enforce proper authorization checks on the assignment_item_id parameter, a classic Insecure Direct Object Reference (IDOR) pattern. An attacker can enumerate or craft integer/string values for assignment_item_id to access records they are not authorized to view or modify. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms the endpoint is reachable over the network with no prerequisites, and the VC:L/VI:L/VA:L metrics indicate limited but real impact across all three security pillars.

RemediationAI

No vendor-released patch has been identified at time of analysis; the maintainer was informed via a GitHub issue (https://github.com/mjperpinosa/stumasy/issues/9) but has not responded. Organizations running stumasy should immediately implement server-side authorization checks on the /PHP/objects/notes endpoint to verify that the requesting user owns or is permitted to access the supplied assignment_item_id before processing - this is the primary remediation. As a compensating control, restrict access to the application behind authentication-enforcing reverse proxy rules (e.g., nginx auth_request or Apache mod_authz) so that unauthenticated requests never reach the PHP endpoint; the trade-off is added infrastructure complexity. Additionally, consider blocking public internet access to the application entirely if it is deployed externally, limiting exposure to internal networks only. Monitor VulDB entry https://vuldb.com/vuln/376342 and the GitHub repository for any future patch commits.