CVE-2026-14719 describes an improper privilege management vulnerability in SourceCodester Onlne Examination & Learning Management System 1.0. The issue resides in the register.php file's registration endpoint, where the 'role' parameter can be manipulated remotely to gain unauthorized privileges. The vulnerability is remotely exploitable without authentication and has a medium severity score of 6.9. No official fix or patch has been disclosed, and the vendor has not provided remediation details. Exploit code is publicly available, increasing the risk of potential attacks.

An attacker can remotely manipulate the 'role' parameter during user registration to escalate privileges improperly. This could allow unauthorized access to restricted functionalities or administrative capabilities within the affected system. The medium CVSS score reflects the potential for privilege escalation without user interaction or prior authentication, but with limited scope and impact as indicated by the CVSS vector components.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the registration endpoint if possible, monitor for suspicious registration activity, and consider implementing manual validation or filtering of role parameters at the application level to prevent unauthorized privilege escalation.