StarTraining EUVD-2026-88035

Requires an authenticated low-privileged StarTraining account (PR:L) with network access to the authRole endpoint; no user interaction. Exploitation works against default configurations because the flaw is in the SysUser.isAdmin authorization logic itself - the endpoint trusts attacker-supplied userId/roleIds as an authorization key without verifying ownership or the caller's privilege. Limiting factors: the attacker must first obtain a valid application account, the product footprint is very small (niche training platform ≤3.8.1), and no vendor patch exists so mitigation depends on access controls or upgrading if/when a fix is released.

This is a genuine but low-priority issue. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N, all impacts Low, no scope change) scores 5.3 Medium and shows a network-reachable, low-complexity flaw that nonetheless requires an authenticated account (PR:L) - so it is a post-authentication privilege issue, not a pre-auth breach. Exploitation status is 'publicly available exploit code exists' (VulDB 410808 and the ArrestX ST-VULN-004 GitHub advisory), which raises practical likelihood, but there is NO EPSS score and NO CISA KEV listing in the input, so there is no evidence of active or widespread exploitation. SSVC-style reading: exploitation=PoC, automatable is plausible for an IDOR but unconfirmed, technical impact is rated partial by the vendor. Signals are mostly consistent; the main tension is that CWE-639 role-assignment IDOR framed as 'privesc' in the advisory could yield HIGH impact (self-granting admin) whereas the vendor scored all impacts Low - the terse VulDB description does not let us confirm the true blast radius, so treat the impact as uncertain. Net: real, PoC-backed, but a niche product with a required foothold - modest real-world risk.

An attacker who already holds a low-privileged StarTraining account calls the authRole endpoint and tampers with the userId/roleIds parameters, which are trusted as a user-controlled key without an ownership/authorization check (CWE-639). By supplying another user's ID or an elevated role ID, the attacker reassigns roles - potentially granting themselves administrative privileges. A public exploit/advisory (ST-VULN-004) documents the request, lowering the skill needed to reproduce it.