CVE-2026-14778 describes an improper authorization vulnerability in SourceCodester Onlne Examination & Learning Management System 1.0. The vulnerability is located in the Enrollment Management component's /ajax_enroll.php file. By manipulating the student_id, schedule_id, or action arguments, an attacker can bypass authorization checks remotely without requiring privileges or user interaction. The vulnerability has been publicly disclosed but no known exploits are reported in the wild. No vendor advisory or patch information is currently available, and the remediation level is unknown.

Successful exploitation allows an unauthenticated remote attacker to bypass authorization controls related to enrollment management functions. This could lead to unauthorized actions or access within the system's enrollment processes. The CVSS 4.0 base score of 6.9 (medium severity) reflects network attack vector, low complexity, no privileges required, and low impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the vulnerable endpoint and monitor for suspicious activity related to enrollment management. Avoid exposing the affected system to untrusted networks if possible.