The vulnerability CVE-2026-97878 affects zhistaredu StarTraining up to version 3.8.1. It is caused by missing authentication checks in the anonymous function of the /druid/index.html file in the Druid Console component. This allows remote attackers to access functionality without authentication. The vulnerability has a CVSS 4.0 base score of 6.9 (medium severity) with network attack vector, low complexity, no privileges required, no user interaction, and low impacts on confidentiality, integrity, and availability. Public exploit code exists, but no active exploitation has been confirmed. The vendor has not provided any response or patch.

Remote attackers can bypass authentication controls in the Druid Console component of affected StarTraining versions, potentially gaining unauthorized access to functionality. The impact on confidentiality, integrity, and availability is assessed as low. No known active exploitation in the wild has been reported.

No official patch or remediation is currently available. The vendor has not responded to disclosure requests. Users should monitor vendor communications for updates. Until a fix is provided, consider restricting network access to the Druid Console component to trusted users only to reduce exposure.