CVE-2026-75458: n/a

The vulnerability in XueZhiSi Open Source Exam System (<= 3.9.0) occurs because the API endpoint POST /api/teacher/user/delete/{id} executes user deletion functions without validating if the requesting user has sufficient privileges. Specifically, the sequence getUserById(id), setDeleted(true), and updateByIdFilter() is performed without checking the current user's role. Consequently, a teacher (role=2) can delete an administrator (role=3), constituting vertical privilege escalation. This is classified under CWE-639 (Authorization Bypass Through User-Controlled Key).

An authenticated user with teacher privileges can delete administrator accounts, potentially disrupting administrative control and causing denial of service or unauthorized modification of user data. The vulnerability does not impact confidentiality but has high impact on integrity and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the affected API endpoint to trusted users only or implement additional access control checks at the application or network level to prevent unauthorized deletions.