College Management System CVE-2026-86215

Exploitation requires the attacker to first hold a valid, authenticated session (PR:L) - either through their own credentials or by obtaining another user's session token via network interception or XSS. The vulnerability is in the server-side logout logic of Front-end/server.php: if the log_out argument is manipulated, the server does not destroy the session. No special non-default configuration is required beyond the application being deployed and accessible over a network. Limiting factors: the attacker must be authenticated at some privilege level prior to exploitation; unauthenticated remote exploitation is not supported by the CVSS vector. Impact is confined to session persistence - not direct code execution or privilege escalation beyond the already-held session.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N, score 5.3) classifies this as a medium-severity, low-privilege authenticated attack with minimal confidentiality and limited integrity impact. The E:P modifier (exploit publicly available) elevates urgency somewhat. Real-world risk is constrained by several factors: exploitation requires prior authentication (PR:L), the product is an obscure open-source hobby/educational project with a small deployment footprint, and the integrity impact is limited to session continuation rather than full system compromise. The 'Information Disclosure' tag in the input metadata is a mislabel - CWE-613 is fundamentally about broken session lifecycle management, not direct data exposure. No EPSS data was provided; given the niche product and moderate CVSS, automated mass exploitation is unlikely. The maintainer has not responded to the responsible disclosure, so no patch exists.

An attacker with valid low-privilege credentials logs in to a College Management System instance and obtains a session token. The attacker then crafts a request to Front-end/server.php that manipulates the log_out parameter in a way that bypasses proper session invalidation, allowing them to continue using the captured session token after the expected logout event - retaining access to the authenticated user's application context. A public proof-of-concept demonstrating this behavior is available via the GitHub issue tracker.