CVE-2026-75460: n/a

CVE-2026-75460 describes a privilege escalation vulnerability in XueZhiSi Open Source Exam System versions <= 3.9.0. The issue exists in the teacher-end API endpoint POST /api/teacher/user/page/list, where the role parameter in the UserPageRequestVM object is not properly restricted and can be manipulated by an attacker. This allows a user with limited privileges to escalate their privileges by controlling the role parameter. The vulnerability is categorized under CWE-639 (Authorization Bypass Through User-Controlled Key).

An attacker with some level of access to the teacher-end interface can manipulate the role parameter to escalate privileges, potentially gaining unauthorized access to higher privilege functions or data. The CVSS v3.1 base score is 6.5 (medium severity), reflecting network attack vector, low attack complexity, requiring low privileges, no user interaction, unchanged scope, high confidentiality impact, and no integrity or availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround has been documented at this time. Until a patch is available, restrict access to the affected API endpoint and monitor for suspicious activity related to role parameter manipulation.