XueZhiSi XZS CVE-2026-75458

Exploitation requires a valid authenticated teacher session (role=2) on the target XZS instance - a lower-privileged credential is not sufficient to reach this endpoint, and unauthenticated access is blocked. The attacker must know or enumerate at least one administrator user ID, which may be discoverable through other application features. No non-default configuration, specific platform version, or unusual deployment mode is required beyond the existence of a teacher-role account. Exploitation scope is strictly limited to account deletion: there is no code execution, no data exfiltration, and no lateral movement pathway inherent to this flaw. Deployments that restrict teacher account creation to a trusted, vetted population significantly limit the realistic threat actor pool.

The CVSS 3.1 base score of 8.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H) accurately reflects the attack profile: network-reachable, low complexity, requiring only a low-privilege authenticated session, with high integrity and availability impact from irreversible account deletion. Real-world risk is meaningfully bounded by the prerequisite of a valid teacher credential, which limits the realistic attacker pool to insiders, compromised accounts, or attackers who have already cleared authentication barriers. The EPSS score of 0.15% (4th percentile) is consistent with no observed broad exploitation. Even so, a mid-sized institutional IT department in opole operating an externally accessible XZS instance with open teacher registration should treat this as urgent, because account deletion is immediate and unrecoverable without database backups. The vulnerability is not listed in CISA KEV and no public exploit code has been identified, making this a medium operational priority for affected operators rather than an emergency patch-now scenario.

An attacker with a valid teacher account (role=2) - whether a legitimate insider or a user whose credentials were compromised - enumerates administrator user IDs through the application UI or ancillary API endpoints, then submits a standard authenticated POST /api/teacher/user/delete/{admin_id} request for each target. The server executes the delete sequence without any role boundary check, permanently removing the administrator account. No exploit code has been publicly released, but the attack requires only a single authenticated HTTP request per target account.