CVE-2026-86277: Authorization Bypass in SourceCodester Syllabus-Aligned Learning Management & Examination System

This vulnerability affects SourceCodester Syllabus-Aligned Learning Management & Examination System 1.0. It involves an authorization bypass in the delete_exam.php file due to improper validation of the ID parameter. An attacker can remotely manipulate this parameter to bypass authorization controls and perform unauthorized operations. The vulnerability has been publicly disclosed, and exploit code is available, but there is no indication of active exploitation in the wild. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges or user interaction required, with low to limited confidentiality, integrity, and availability impacts.

An attacker can remotely bypass authorization controls to perform unauthorized actions related to exam deletion. This could lead to unauthorized modification or deletion of exam data, potentially disrupting the learning management system's integrity and availability. The impact is rated medium severity based on CVSS 4.0 scoring.

No official patch or remediation information is provided. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the affected delete_exam.php functionality and monitor for suspicious activity related to exam deletion requests.