CET Grading System CVE-2026-76999

Exploitation requires an authenticated session with at least low-level privileges on the CET Automated Grading System (CVSS PR:L), consistent with a student, instructor, or operator account. The attacker must be able to submit HTTP requests to the /index.php endpoint and supply a student_id value belonging to a different user. No special configuration, non-default deployment mode, or additional tooling is required beyond a valid login and knowledge of another student's identifier. Exploitation is limited by the requirement for prior authentication - unauthenticated external attackers cannot directly exploit this flaw without first obtaining credentials. The attack surface is further limited to installations that are network-accessible (AV:N), so instances restricted to local or intranet access reduce external exposure.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L) assigns a score of 5.3 (Medium), which is consistent with a low-complexity network-reachable IDOR requiring only low-level authentication. The PR:L metric confirms exploitation requires an existing authenticated session, which meaningfully constrains the attacker population relative to a fully unauthenticated flaw. No EPSS score was provided, no KEV listing exists, and no public proof-of-concept code was referenced - all three signals suggest this has not been weaponized in the wild. Real-world risk is further constrained by the product's narrow deployment footprint (a free SourceCodester PHP script used primarily in academic and hobbyist settings). Despite the network-reachable vector, this is a low-priority finding for most security teams unless the system is publicly exposed and handles consequential academic records. The VA:L (availability) rating in the source vector is noted but not independently obvious from the description - this may reflect indirect disruption from unauthorized grade manipulation rather than a direct denial-of-service condition.

An authenticated student or staff member with a valid session crafts an HTTP request to /index.php targeting the add_grade function, substituting a victim student's student_id in place of their own. Because the server does not validate record ownership, the attacker's grade submission is applied to the target student's record, allowing grade inflation or sabotage of another student's academic standing. No public proof-of-concept code has been referenced, but the low complexity of parameter manipulation makes this trivially reproducible by any authenticated user with basic web developer tools.