Syllabus LMS CVE-2026-86281

The victim must be authenticated to the Syllabus-Aligned Learning Management & Examination System and must visit an attacker-controlled web page or resource while their session is active - this is the UI:P requirement captured in the CVSS vector. The attacker requires no credentials or prior access. The application must be reachable over the network by the victim's browser. Exploitation is limited by the need for victim interaction and the narrow real-world deployment of this hobbyist LMS product; it does not affect default browser configurations that enforce SameSite=Lax on cookies, which modern browsers apply by default.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P) scores 5.3, reflecting a moderate-severity flaw with low complexity and no required attacker privileges, but dependent on victim interaction (UI:P) and limited to low integrity impact. The E:P exploitability supplement confirms a public proof-of-concept exists. No CISA KEV listing means active exploitation is not confirmed. Real-world risk is further limited by the product's extremely narrow deployment footprint - SourceCodester distributes hobbyist/student source code projects with negligible enterprise adoption. The CVSS impact metrics (VI:L, no confidentiality or availability impact) correctly constrain the severity; the CSRF can trigger unauthorized writes or state changes but does not expose data or crash the system. Overall, this is a low-priority finding outside of environments that have specifically deployed this software.

An attacker hosts a malicious web page containing a hidden HTML form targeting a state-changing endpoint in the LMS (such as grade modification or account update) and distributes the link to a victim who is actively logged into the application. When the victim visits the attacker's page, their browser automatically submits the forged request with the victim's active session cookie, causing the server to execute the action without the victim's knowledge. A public proof-of-concept demonstrating this technique against specific LMS endpoints is available on GitHub.