CVE-2026-2938 identifies an improper access control vulnerability in SourceCodester Student Result Management System version 1.0, specifically within the /srms/script/admin/core/update_smtp.php file. The vulnerability arises from insufficient authorization checks in an unknown function of this script, allowing remote attackers to invoke it without authentication or user interaction. This flaw enables unauthorized users to modify SMTP configuration settings remotely, which could be leveraged to redirect email communications, facilitate phishing attacks, or disrupt email-based notifications. The CVSS 4.0 base score of 6.9 reflects a medium severity, with attack vector being network (remote), low attack complexity, no privileges or user interaction required, and limited impact on confidentiality, integrity, and availability. Although no active exploits have been reported, the public disclosure of the vulnerability increases the likelihood of exploitation attempts. The absence of official patches necessitates immediate mitigation efforts by administrators. The vulnerability primarily affects educational institutions and organizations using this specific version of the Student Result Management System, which is often deployed in regions where SourceCodester products have market presence.

The vulnerability allows attackers to remotely alter SMTP settings without authentication, potentially compromising the confidentiality and integrity of email communications. This can lead to interception or redirection of sensitive student data, phishing campaigns using legitimate email infrastructure, and disruption of notification services. Organizations relying on this system for managing student results may face data breaches, reputational damage, and operational disruptions. The impact is particularly significant for educational institutions that handle sensitive personal and academic information. While availability impact is limited, the integrity and confidentiality risks pose serious concerns. The exploitability without authentication and user interaction increases the threat level, especially in environments exposed to the internet or untrusted networks.

Administrators should immediately restrict access to the /srms/script/admin/core/update_smtp.php script by implementing network-level controls such as IP whitelisting or VPN access to limit exposure. If possible, apply custom access control checks or web application firewall (WAF) rules to block unauthorized requests targeting this endpoint. Regularly monitor logs for suspicious access patterns related to SMTP configuration changes. Since no official patch is currently available, consider isolating the affected system from public networks or replacing it with updated, secure alternatives. Educate staff about the risks of phishing and suspicious emails that could result from SMTP manipulation. Implement multi-factor authentication and strong access controls on administrative interfaces to reduce the risk of lateral attacks. Finally, stay updated with vendor advisories for any forthcoming patches or mitigations.