CVE-2026-82621: Authorization Bypass in Soarkey StudentManagement

This vulnerability in Soarkey StudentManagement impacts the AdminDao.doGet function within the Administrative Servlet. By manipulating the 'action' argument, an attacker can bypass authorization checks remotely. The affected versions include all versions up to commit e08f7f1d5015af407aa4cca0ada3dea189b4937e. The vulnerability has a CVSS 4.0 base score of 6.9 (medium severity), indicating network attack vector, low complexity, no privileges or user interaction required, and low to limited impact on confidentiality, integrity, and availability. Public exploit code is available, but no official remediation or patch has been published by the vendor as of the publication date.

Successful exploitation allows remote attackers to bypass authorization controls in the administrative interface of Soarkey StudentManagement, potentially granting unauthorized access to administrative functions. This could lead to unauthorized data access or administrative actions within the affected system. The impact on confidentiality, integrity, and availability is rated as low to limited according to the CVSS vector.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or released a fix, users should monitor official channels for updates. In the meantime, restricting network access to the administrative interface and applying compensating controls to limit exposure may reduce risk.