fuzui StudentInfo EUVD-2026-88061

Requires an authenticated session on the target StudentInfo instance (PR:L) with network reach to the /StudentInfo/StudentHandler/moditypasswordstu password-change endpoint; the attacker manipulates the sid/tid argument to reference a victim account. Exploitation is limited by the need for a valid account and knowledge or enumeration of target sid/tid values; the vendor asserts user interaction (UI:P) but a direct IDOR on this endpoint likely needs none. No fixed release exists (rolling release) and the vendor is unresponsive, so no patched configuration is available.

The vendor CVSS 4.0 score of 5.1 (medium) reflects an authenticated (PR:L) remote authorization-bypass with the vendor rating all impacts as Low (VC:L/VI:L/VA:L) and asserting user interaction (UI:P). However, CWE-639 (Insecure Direct Object Reference) on a password-change endpoint typically enables account takeover: by tampering with the sid/tid identifier an attacker can reset another user's - potentially an administrator's - password, which is better characterized as high integrity impact plus takeover of the victim's confidentiality and possible lockout (availability). This suggests the vendor may understate real impact. On exploitation signals: there is no EPSS score, no CISA KEV listing, and no explicit proof-of-concept flag in the provided data (exploit maturity E:X = Not Defined), so this is not a confirmed-exploited or widely-automated threat. The single reporting source is VulDB, the vendor did not respond, and the product is an obscure GitHub project, so despite the potentially higher-than-rated impact this is a LOW real-world priority driven by negligible deployment footprint rather than by low technical severity. Note the metric conflict: vendor sets UI:P but a direct IDOR on a password-change request generally requires no victim interaction - verify against the actual endpoint behavior.

An attacker registers or obtains a low-privilege account on a StudentInfo deployment, then sends a crafted request to /StudentInfo/StudentHandler/moditypasswordstu substituting another user's sid/tid value. Because the endpoint fails to verify that the identifier belongs to the requester, the attacker sets a new password for the victim account and takes it over. No public exploit code is identified in the provided data, though the attack is trivial to reproduce given the description.