CVE-2026-111870: Missing Authentication in itsmeravitejak Online-Examination-System

This vulnerability in the itsmeravitejak Online-Examination-System involves missing authentication in the isAdmin function located in admin/admin.php. An attacker can remotely manipulate this function to bypass authentication controls. The product's continuous delivery model means no discrete version numbers are provided for affected or patched releases. The issue was responsibly disclosed to the project, but no response or fix has been issued. The CVSS 4.0 base score is 6.9, indicating medium severity with network attack vector, low complexity, no privileges or user interaction required, and partial impact on confidentiality.

Successful exploitation allows an unauthenticated remote attacker to bypass authentication controls, potentially gaining unauthorized administrative access. This could lead to unauthorized actions within the Online-Examination-System. However, the impact is limited to confidentiality loss with no reported integrity or availability impact. No active exploitation in the wild is currently known.

No official fix or patch is currently available. The vendor has not responded to the issue report. Users should monitor the vendor's communications for updates. Until a fix is released, restricting access to the admin interface by network controls or other compensating controls may reduce exposure. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.