CVE-2026-78115 describes an authorization bypass vulnerability in SourceCodester Class and Exam Timetabling System 1.0. The flaw exists in an unspecified function within /admin/edit_user_account.php related to user account updates. By manipulating the id or username parameters, an attacker with some privileges (low attack complexity, requires privileges) can bypass proper authorization controls. The vulnerability is remotely exploitable without user interaction. The CVSS 3.1 base score is 5.4, indicating a medium impact primarily due to integrity and availability impacts, but no confidentiality impact. Public exploit information is available, but no official patch or fix has been disclosed.

The vulnerability allows improper authorization, which can lead to unauthorized modification of user accounts. This impacts the integrity and availability of the system but does not affect confidentiality. The attack can be performed remotely and requires some privileges, with low attack complexity and no user interaction needed. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected component and monitor for suspicious activity related to user account modifications. Avoid exposing the administration interface to untrusted networks.