This vulnerability in Kushan2k student-management-system up to commit f16a4ceaddd6729c4b306ed4641cda3176c1ef2a allows an attacker to manipulate the isadmin argument in the edit-admin function of controllers/AdminController.php, resulting in improper authorization. This flaw affects the Profile Update Endpoint and can be exploited remotely without user interaction or elevated privileges beyond limited privileges. The vulnerability has a CVSS 4.0 base score of 5.3 (medium severity). The project was notified early but has not issued a fix or advisory, and no patch links are available. The vulnerability is publicly disclosed, increasing risk of exploitation.

Successful exploitation can allow an attacker with limited privileges to improperly escalate authorization, potentially modifying administrative profiles or privileges. This could lead to unauthorized administrative access or changes within the student-management-system. The vulnerability does not require user interaction and can be exploited remotely, increasing its risk. However, the impact is rated medium due to the requirement of some privilege and the limited scope of the authorization bypass.

No official fix or patch is currently available from the vendor. Since the vendor has not responded or released a remediation, organizations should monitor the vendor's channels for updates. Until a patch is released, restrict access to the Profile Update Endpoint to trusted users only and consider implementing additional access controls or monitoring to detect unauthorized privilege changes. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.