EUVD-2026-19786Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
Lifecycle Timeline
4DescriptionGitHub Advisory
PolarLearn is a free and open-source learning program. In 0-PRERELEASE-14 and earlier, setCustomPassword(userId, password) and deleteUser(userId) in the account-management module used an inverted admin check. Because of the inverted condition, authenticated non-admin users were allowed to execute both actions, while real admins were rejected. This is a direct privilege-escalation issue in the application.
AnalysisAI
Privilege escalation in PolarLearn account-management module allows authenticated non-admin users to arbitrarily reset passwords and delete user accounts due to an inverted admin permission check in versions 0-PRERELEASE-14 and earlier. The inverted logic in setCustomPassword() and deleteUser() functions grants administrative capabilities to regular users while blocking legitimate administrators. With a CVSS score of 8.8 and network-based attack vector requiring only low-privilege authentication, this represents a critical account takeover risk. No public exploit identified at time of analysis, though the authentication bypass nature (per tags) makes exploitation straightforward once the flaw is understood.
Technical ContextAI
This vulnerability stems from a boolean logic error (CWE-285: Improper Authorization) in PolarLearn's account-management module. The admin permission check in two privileged functions-setCustomPassword(userId, password) and deleteUser(userId)-was implemented with inverted conditional logic, likely using a negated or reversed comparison operator. Instead of verifying 'if (user.isAdmin())' the code appears to have implemented 'if (!user.isAdmin())' or equivalent inverted logic. This causes the authorization gate to deny access to legitimate administrators while granting access to any authenticated non-admin user. PolarLearn is an open-source learning management platform, and this flaw affects the core user account administration functionality that should be strictly restricted to privileged roles. The improper authorization class (CWE-285) represents a fundamental failure in access control implementation rather than a missing check-the check exists but operates inversely to its intended security purpose.
RemediationAI
Upgrade immediately to PolarLearn version 0-PRERELEASE-15 or later, where the inverted admin permission check has been corrected in the account-management module. The fix involves correcting the boolean logic in the authorization checks for setCustomPassword(userId, password) and deleteUser(userId) functions to properly validate administrator privileges before allowing execution. Review the official GitHub Security Advisory at https://github.com/polarnl/PolarLearn/security/advisories/GHSA-8hww-w7cc-77rj for detailed remediation guidance and to confirm the patched version. Until patching is complete, implement compensating controls including disabling user self-registration if enabled, monitoring account management API endpoints for suspicious password reset or user deletion activity by non-admin accounts, and conducting an audit of recent account modifications to identify potential exploitation. No effective workaround exists short of disabling the vulnerable account management functions entirely, which would break core platform functionality. Given the pre-release status of affected versions, production deployments should carefully evaluate whether PolarLearn has reached appropriate maturity for security-sensitive educational environments.
More in Polarlearn
View allPolarLearn versions 0-PRERELEASE-15 and earlier lack proper state parameter validation in OAuth 2.0 authentication, enab
Unauthenticated message injection in PolarLearn 0-PRERELEASE-16 and earlier allows remote attackers to send persistent m
Email enumeration in PolarLearn through timing analysis of the login endpoint allows unauthenticated attackers to identi
PolarLearn versions prior to 0-PRERELEASE-15 fail to validate the `direction` parameter in the forum vote API endpoint,
Authentication bypass in PolarLearn ≤0-PRERELEASE-15 allows unauthenticated remote attackers to gain authenticated sessi
Same weakness CWE-285 – Improper Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today