EUVD-2026-88034
GHSA-jhvq-wcgv-25hr
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as low-privilege user
-
DeliverySend request to dataScope role endpoint
-
ExploitBypass missing checkRoleAllowed authorization
-
ExecutionPerform unauthorized role CRUD
-
ImpactAlter role/data-scope integrity
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires an authenticated low-privilege account on a StarTraining ≤3.8.1 instance (PR:L) with network reachability to the application's role-management dataScope endpoint. The specific enabling defect is that the checkRoleAllowed function in SysRoleServiceImpl.java performs role CRUD without an authorization guard (advisory: missing @PreAuthorize), so any logged-in user can invoke privileged role operations. Limiting factors: valid credentials are needed (not unauthenticated), impact is confined to integrity-low (role/data-scope tampering) with no direct confidentiality or availability effect per the vendor vector, and the product is obscure with a tiny deployment base. No user interaction is required. |
| Impact | This is a high-CVSS-inflated-but-low-real-risk issue. The vendor/VulDB CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N, score 5.3) already caps impact at integrity-low with no confidentiality or availability effect, and requires authentication (PR:L). CWE-862 (missing authorization) matches the described root cause - the checkRoleAllowed function / dataScope endpoint lacks an authorization guard (advisory title notes a missing @PreAuthorize on role CRUD). Signals partly reinforce and partly temper each other: a public POC exists (ArrestX advisory ST-VULN-005) and SSVC/CVSS exploit maturity is E:P (proof-of-concept), which raises tractability, BUT there is no EPSS score, no CISA KEV listing, and no evidence of active exploitation. Exploitation status is therefore: publicly available exploit code exists - this must NOT be conflated with active exploitation. The requirement for an authenticated low-privilege account (PR:L) plus the obscure, tiny-footprint nature of StarTraining sharply limits real-world impact. Note the input Tag 'Authentication Bypass' conflicts with the actual CWE-862 authorization flaw - this is broken access control (authorization), not authentication bypass; treat that label with caution. |
| Exploit ScenarioDerived | A low-privileged authenticated user of a StarTraining ≤3.8.1 instance sends a crafted request directly to the role-management dataScope endpoint whose checkRoleAllowed method omits the authorization/@PreAuthorize check. Because the server does not verify the caller's role entitlements, the attacker performs role CRUD operations they should not be permitted, tampering with role/data-scope configuration. A public proof-of-concept exploit is available in the ArrestX startraining-advisories repository. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 27, 2026
Missing authorization in zhistaredu StarTraining up to and including version 3.8.1 lets any authenticated low-privilege user invoke privileged role-management operations through the dataScope endpoint, because the checkRoleAllowed function in SysRoleServiceImpl.java performs role CRUD without an authorization guard. Exploitation requires only a valid low-privilege account (CVSS 4.0 PR:L, network reachable) and no user interaction; the outcome is integrity-low role and data-scope tampering with no direct confidentiality or availability impact. Publicly available exploit code exists (referenced from the ArrestX/startraining-advisories ST-VULN-005 advisory) and the vendor did not respond to early disclosure, so no vendor-released patch has been identified at time of analysis; the product has a small deployment base, which limits real-world exposure.
RemediationAI
No vendor-released patch has been identified at time of analysis - the maintainer was contacted early and did not respond, so there is no confirmed fixed version to upgrade to and administrators should not assume that a later 3.8.x release addresses the flaw without vendor confirmation. The most direct fix, if the source is available to you, is to add the missing authorization guard to SysRoleServiceImpl.checkRoleAllowed (per the public advisory, restoring the absent @PreAuthorize annotation on the role CRUD methods) and to enforce role/data-scope checks server-side rather than relying on endpoint reachability; recompile and redeploy the affected service, and note that this is a code change requiring a full application build rather than a configuration toggle. Where source modification is not feasible, compensating controls include restricting network access to the dataScope/role-management endpoints via a reverse proxy or WAF rule so that only trusted administrative source addresses can reach them (side effect: legitimate remote admins lose access unless allowed-listed), and auditing or reducing the population of low-privilege accounts that can authenticate to the instance, since the flaw only manifests post-authentication (side effect: operational overhead and no protection against a compromised legitimate account). Additionally, monitor logs for unexpected role CRUD or data-scope changes issued by non-administrative accounts, and review role/permission assignments for tampering as a detection measure. Refer to the advisory at https://github.com/ArrestX/startraining-advisories/blob/main/advisories/ST-VULN-005-role-crud-missing-preauthorize.md for the specific method and annotation involved before applying any workaround.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
StarTraining is a Java-based training/management application whose back end implements role-based access control through a Spring service layer; the affected class SysRoleServiceImpl exposes checkRoleAllowed, invoked from the dataScope-related endpoint. The root-cause class is CWE-862 (Missing Authorization): the method performs role create/read/update/delete (CRUD) logic without enforcing the expected authority check - per the public advisory this corresponds to a missing @PreAuthorize annotation, so the authorization decision is never evaluated and any caller who has already authenticated (including an ordinary low-privilege user) can reach privileged role and data-scope functions. The CPE cpe:2.3:a:zhistaredu:startraining:*:*:*:*:*:*:*:* confirms the whole product line through 3.8.1 is affected, and the 'Authentication Bypass' tag reflects the resulting privilege-escalation-through-authorization-gap pattern. Because the vulnerability is a logic/annotation omission rather than a memory-safety or injection bug, exploitation is a straightforward authenticated request to the exposed endpoint, which is why public PoC material exists, though the assessed impact vector (VC:N/VI:L/VA:N) shows the practical effect is limited to integrity of role and data-scope configuration.
Know when Startraining gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P
Remote authenticated low-priv user (PR:L) hits an unguarded role endpoint; impact limited to integrity (role tampering, I:L), no confidentiality or availability effect per vendor scoping.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A security flaw has been discovered in zhistaredu StarTraining up to 3.8.1. This affects the function checkRoleAllowed of the file SysRoleServiceImpl.java of the component dataScope Endpoint. The manipulation results in missing authorization. The attack may be performed from remote. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Startraining
View allUnauthenticated access to the Swagger/OpenAPI api-docs endpoint in zhistaredu StarTraining through 3.8.1 allows remote a
Unauthenticated remote access to the Alibaba Druid monitoring console bundled with zhistaredu StarTraining 3.8.1 and ear
StarTraining 3.8.1 and earlier embeds a hard-coded JWT signing secret in application.yml, allowing an unauthenticated re
Authorization bypass in zhistaredu StarTraining through 3.8.1 allows an authenticated low-privileged user to escalate pr
Cross-site scripting in zhistaredu StarTraining up to and including 3.8.1 becomes exploitable when the built-in XSS filt
Exploit-DB