CVE-2026-86215: Session Expiration in Mstfakts College-Management-System

This vulnerability in Mstfakts College-Management-System arises from an issue in the Logout Handler's unknown function within Front-end/server.php. Manipulating the log_out argument causes session expiration, which can be triggered remotely. The exploit code is publicly available. Due to the product's rolling release model, no explicit affected or fixed versions are identified. The vendor has not responded to the issue report as of the publication date.

An attacker can remotely cause session expiration by manipulating the log_out argument, potentially disrupting user sessions. The CVSS 4.0 score of 5.3 (medium severity) reflects that the attack requires low complexity and no user interaction but does not escalate privileges or cause confidentiality or integrity loss.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no patch is available, monitor official channels for updates. In the meantime, consider implementing additional session management controls or monitoring to detect abnormal logout activity.