CVE-2026-35610 is an improper authorization vulnerability (CWE-285) in PolarLearn (<= 0-PRERELEASE-14). The account-management module's setCustomPassword and deleteUser functions incorrectly implement an admin check with inverted logic. Consequently, authenticated users without admin privileges can reset passwords and delete user accounts, while legitimate admins are blocked from these actions. This logic error leads to privilege escalation, compromising confidentiality, integrity, and availability of user accounts. The vulnerability is network exploitable with low attack complexity and no user interaction required, reflected by a CVSS 3.1 score of 8.8.

Exploitation allows authenticated non-admin users to escalate privileges by resetting passwords and deleting user accounts, potentially leading to full account takeover and denial of service. The vulnerability impacts confidentiality, integrity, and availability of the affected system. There are no reported exploits in the wild, but the high CVSS score indicates significant risk if exploited.

No official patch or remediation is currently available for this vulnerability. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, restrict access to authenticated user accounts and monitor for suspicious activity related to account management functions. Avoid using affected versions of PolarLearn in production environments if possible.