StudentManagement CVE-2026-82621

The Administrative Servlet (AdminDao) must be deployed and reachable over the network, which is the default state for this web application when running. No authentication is required (PR:N per CVSS 4.0 vector), no special configuration must be enabled, and no user interaction is needed. The attacker need only supply a crafted action parameter value in an HTTP request to the servlet endpoint. The sole limiting factor is network reachability: if the application is not externally accessible or is restricted by firewall rules to trusted IP ranges, exploitation requires network-adjacent positioning. Default deployments with no network restrictions are vulnerable without any further preconditions.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) represents the most permissive possible access profile: network-reachable, low complexity, no authentication, no prerequisites, no user interaction. The E:P modifier confirms a public proof-of-concept exists, further lowering attacker barriers. Impact is bounded at VC:L/VI:L/VA:L - limited rather than critical - suggesting partial administrative data exposure or modification rather than full system compromise. No EPSS data was provided in the input, so probabilistic exploitation likelihood cannot be quantified. This is not listed in CISA KEV, indicating no confirmed widespread active exploitation at time of analysis. The most significant risk mitigant is prevalence: this appears to be a niche open-source hobby project rather than enterprise-deployed software, substantially limiting real-world blast radius despite the permissive attack vector. For organizations that do deploy this software, the unpatched status and public exploit make this an immediate priority.

An unauthenticated remote attacker sends a crafted HTTP GET request to the Administrative Servlet endpoint with a manipulated action parameter value that circumvents the authorization logic in AdminDao.doGet(). The server grants access to administrative functions - such as querying, modifying, or deleting student records - without verifying the caller's identity or role. A public proof-of-concept demonstrating this manipulation is available via the project's GitHub issue tracker, making replication straightforward for any attacker with network access to the application.