The vulnerability in Soarkey StudentManagement up to commit e08f7f1d5015af407aa4cca0ada3dea189b4937e resides in the RegisterServlet.doPost function within the Registration Workflow component. Improper handling of the 'level' argument leads to improper privilege management, enabling remote attackers to manipulate privileges. The product lacks versioning, so affected versions cannot be precisely identified. The issue was reported to the project early, but no response or fix has been provided. Public exploit code exists, though no active exploitation in the wild is confirmed.

An attacker can remotely manipulate the 'level' argument during registration to gain unauthorized privileges within the Soarkey StudentManagement system. This could lead to unauthorized access or actions beyond intended permissions. The CVSS 4.0 score of 6.9 reflects a medium severity with network attack vector, no privileges required, and no user interaction needed.

No official patch or fix is currently available, and the vendor has not responded to the issue report. Users should monitor the vendor's communications for updates. Until a fix is released, consider restricting access to the registration functionality or implementing additional access controls to mitigate exploitation risk.