This vulnerability affects the checkRoleAllowed function in the SysRoleServiceImpl.java file of the dataScope endpoint in zhistaredu StarTraining up to versions 3.8.0 and 3.8.1. The flaw results in missing authorization, enabling remote attackers to perform actions without proper permissions. The vulnerability has a CVSS 4.0 base score of 5.3, indicating medium severity. Public exploit code has been released, increasing the risk of exploitation. The vendor has not responded to disclosure and no patch or mitigation guidance is available.

The missing authorization vulnerability allows remote attackers with low privileges to bypass role checks, potentially leading to unauthorized access or actions within the affected component. While the CVSS score indicates medium severity, the public availability of exploit code elevates the risk of exploitation. There is no evidence of active exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no official fix is available, organizations should consider implementing compensating controls such as restricting access to the affected endpoint and monitoring for suspicious activity related to role authorization bypass attempts.