Soarkey StudentManagement CVE-2026-90787

Exploitation requires that the application's self-registration endpoint is network-accessible and open to the public (or the attacker has network-level access to it). No authentication is required prior to exploitation - the attack occurs during the account creation flow. The vulnerable parameter is level in the POST body submitted to RegisterServlet.doPost via register.html. The only limiting factor is whether the registration endpoint is reachable; if the application is deployed in an isolated or internal-only network, external attackers cannot exploit it. No specific browser, OS, or protocol configuration is required - any HTTP client capable of sending a POST request is sufficient.

The CVSS 4.0 score of 5.5 (Medium) reflects partial impact across confidentiality, integrity, and availability (VC:L/VI:L/VA:L), with no authentication requirement and no user interaction. SSVC classifies exploitation as automatable and technical impact as partial, consistent with the CVSS assessment. A publicly available exploit (GitHub issue #35) exists but no CISA KEV listing is present, meaning confirmed widespread active exploitation is not established. Real-world risk is constrained by the extremely limited deployment footprint - StudentManagement appears to be a hobby/educational GitHub project with no evidence of production enterprise use. The vulnerability is trivially exploitable (parameter tampering with no complexity), but the population of exposed instances is negligible. Organizations running this specific project in production should treat this as high priority due to ease of exploitation; for the broader security community it is low priority.

An attacker visits the publicly accessible registration page, intercepts the POST request to RegisterServlet.doPost, and modifies the level parameter from a normal user value (e.g., 1) to an administrative value (e.g., 0 or admin). The server accepts the manipulated value without validation and creates an account with elevated privileges, giving the attacker admin-level access to student records and management functions. A working proof-of-concept is referenced in GitHub issue #35.