Syllabus-Aligned LMS CVE-2026-86275

No special conditions are required beyond network access to the registration endpoint. The vulnerability exists in the default configuration of SourceCodester Syllabus-Aligned Learning Management & Examination System 1.0 whenever the self-registration feature is enabled and publicly reachable. No authentication is required prior to exploitation - the flaw is triggered during the unauthenticated account-creation flow. Exploitation is limited to instances where the registration endpoint (auth.php) is internet-accessible or reachable by an attacker; systems placed behind authentication-required network perimeters or VPNs, or those with self-registration disabled, are not directly exposed.

The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/E:P) correctly identifies this as a remotely exploitable, no-authentication-required flaw with a public exploit. However, the scored VI:L appears understated: successfully registering as an administrator grants full integrity control over application data, users, syllabi, and examination records - an outcome more consistent with VI:H. The EPSS data is absent, but the combination of a trivial attack path, no prerequisites, and a public PoC published on GitHub elevates real-world risk above the 6.9 base score implies. KEV status has not been confirmed, so active exploitation is not established. For any instance exposed to the internet, this should be treated as high-priority due to zero-friction exploitation. The primary limiting factor is the product's niche academic deployment base.

An attacker sends a crafted HTTP POST registration request to the publicly accessible auth.php endpoint, including a manipulated role parameter set to admin or an equivalent privileged value. The application persists this attacker-chosen role without validation, creating an administrator account under attacker control. The attacker then logs in with full administrative access to manage users, access examination data, alter grades, or pivot further within the server environment. A public proof-of-concept on GitHub documents the exact request structure.