CVE-2026-85209 describes a missing authorization vulnerability in the AVEZ Electronics Communication Training and Consultancy Trade Inc. Learning Management System (LMS). This flaw allows attackers with low privileges to exploit incorrectly configured access control security levels, potentially gaining unauthorized access to sensitive information. The vulnerability has a CVSS 3.1 score of 6.5, reflecting a network attack vector, low complexity, and no user interaction required. The issue affects LMS versions up to 2026-09-18. No official patch or vendor advisory is referenced, and no known exploits are reported in the wild.

The vulnerability allows an attacker with low privileges to access sensitive information without proper authorization, impacting confidentiality. There is no impact on integrity or availability. Exploitation does not require user interaction and can be performed remotely over the network.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, review and correct access control configurations in the LMS to ensure proper authorization enforcement.