CVE-2026-86275CWE-266CWE-269privilege-escalation

CVE-2026-86275

Medium · published September 7, 2026

CVSS v3.1
5.3
EPSS
0%
Percentile
40.7
In the wild
Unconfirmed
What it is

A vulnerability was detected in SourceCodester Syllabus-Aligned Learning Management & Examination System 1.0. This vulnerability affects the function register of the file auth.php. Performing a manipulation of the argument role results in improper privilege management. Remote exploitation of the attack is possible. The exploit is now public and may be used.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CVSS v4.0
6.9 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P
EPSS
0.00484 · 40.7th percentile
Weaknesses
CWE-266 · Incorrect Privilege Assignment; CWE-269 · Improper Privilege Management
Published
2026-09-07T10:17Z
References (6)
https://github.com/hackliu/Vulnerability-Reports/blob/master/Syllabus%20Aligned%20Learning%20Management%20Examination%20System/VULN-01-Unauthenticated-Privilege-Escalation.md · [email protected]https://vuldb.com/cve/CVE-2026-86275 · [email protected]https://vuldb.com/submit/904872 · [email protected]https://vuldb.com/vuln/399436 · [email protected]https://vuldb.com/vuln/399436/cti · [email protected]https://www.sourcecodester.com/ · [email protected]
EPSS history
Timeline
  • 08 SEP 03:24Z
    EPSS moved — → 0%
    epss
  • 07 SEP 05:30Z
    SourceCodester Syllabus-Aligned Learning Management & Examination System auth.php register privileges management
    cvelistv5