CVE-2026-86275: Improper Privilege Management in SourceCodester Syllabus-Aligned Learning Management & Examination System

This vulnerability affects SourceCodester Syllabus-Aligned Learning Management & Examination System 1.0. The issue lies in the register function within auth.php, where improper handling of the role argument allows an attacker to manipulate privileges improperly. The vulnerability can be exploited remotely without any privileges or user interaction, as indicated by the CVSS vector. An exploit is publicly available, increasing the risk of exploitation.

Successful exploitation allows an unauthenticated remote attacker to escalate privileges by manipulating the role parameter during registration. This could lead to unauthorized access or actions within the system, potentially compromising the integrity and security of the learning management environment.

No official patch or vendor advisory is currently provided. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the registration functionality if possible and monitor for exploitation attempts.