XueZhiSi Exam System CVE-2026-75460

Exploitation requires a valid teacher-level account on the XueZhiSi exam system - unauthenticated exploitation is not possible per CVSS PR:L. The attacker must have network access to the POST /api/teacher/user/page/list endpoint. No special system configuration or non-default feature flag is required beyond possessing a teacher credential, which is a standard provisioned role in the application. What limits exploitation: (1) a valid teacher credential is mandatory, restricting attackers to insiders or those who have already compromised a teacher account via separate means; (2) the vulnerability is strictly read-only (C:H, I:N, A:N), providing no write, modify, or denial-of-service capability; (3) the product is a niche Chinese-language educational platform with limited global deployment footprint.

The CVSS 3.1 base score of 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) is accurate and well-calibrated - the read-only nature (I:N/A:N) correctly bounds the score below critical despite the high confidentiality impact. EPSS at 0.15% (4th percentile) signals very low observed exploitation probability, consistent with the product's niche educational footprint. The requirement for a valid teacher credential (PR:L) meaningfully restricts the realistic attacker population to insiders or those who have already compromised a teacher account, which is a significant limiting factor. Even a mid-sized municipal IT team in walbrzych deploying an online examination system would only be exposed if they specifically adopted this Chinese-language open-source platform - deployment scope is narrow. CISA KEV is absent and no POC has been identified, placing this in the routine patch-on-schedule category rather than emergency response. The primary risk is insider or credential-compromised enumeration of cross-role user data, including potentially PII, rather than any write or destructive capability.

An attacker holding a valid teacher account authenticates to the xzs application and sends a crafted POST request to /api/teacher/user/page/list with the role parameter set to a privileged value such as admin. The server returns the user listing for that role without verifying the teacher is authorized to query it, allowing the attacker to enumerate all users in the target role tier. Repeated queries across role values expose the full user database, including usernames and any associated PII, without triggering any authorization error.