The vulnerability CVE-2026-90851 affects PHPGurukul Hostel Management System version 3.0. It arises from improper access controls in the /admin/includes/checklogin.php file, specifically through manipulation of the argument ID. This flaw can be exploited remotely without user interaction and with low attack complexity, allowing unauthorized access to restricted functionality. The CVSS 4.0 base score is 5.3 (medium severity), reflecting limited impact on confidentiality, integrity, and availability. An exploit has been published, indicating the vulnerability is known and potentially exploitable.

Successful exploitation can lead to unauthorized access to parts of the application that should be restricted, potentially exposing sensitive administrative functions or data. The impact on confidentiality, integrity, and availability is limited but non-negligible given the administrative context.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the affected system to trusted networks and users only. Monitor for unusual access patterns related to the /admin/includes/checklogin.php endpoint. Consider implementing additional access control mechanisms or input validation as a temporary measure.