CVE-2026-75458

Deferred Deferred - Pending Action

Vertical Privilege Escalation in XueZhiSi Exam System

Publication date: 2026-08-31

Last updated on: 2026-09-01

Assigner: MITRE

Description

The teacher-end interface POST /api/teacher/user/delete/{id} in XueZhiSi Open Source Exam System <= 3.9.0 contains a vertical privilege escalatio vulnerability. This interface accepts a user ID and then executes getUserById(id), setDeleted(true), updateByIdFilter() in sequence, without any validation of whether the current user has the authority to delete the target user. An authenticated teacher user (role=2) can delete an administrator account (role=3), constituting a vertical privilege escalation where a lower-privileged user performs a high-privileged operation.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-31

Last Modified

2026-09-01

Generated

2026-09-21

AI Q&A

2026-09-01

EPSS Evaluated

2026-09-15

NVD

CVE-2026-75458

Affected Vendors & Products

Vendor	Product	Version / Range
xuezisi	open_source_exam_system	to 3.9.0 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-639	The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

Executive Summary

This is a vertical privilege escalation vulnerability in the XueZhiSi Open Source Exam System version 3.9.0 or earlier. An authenticated teacher user can delete administrator accounts by exploiting a flawed endpoint that lacks proper authorization checks.

Detection Guidance

To detect this vulnerability, check if the POST /api/teacher/user/delete/{id} endpoint allows unauthorized role=2 users to delete role=3 accounts. Test by sending a request with a teacher account to delete an admin account ID. Monitor server logs for successful deletions of higher-privileged accounts by lower-privileged users.

Impact Analysis

If you are a teacher using this system, an attacker could exploit this to delete administrator accounts, disrupting system management and potentially causing data loss or service disruption.

Compliance Impact

This vulnerability allows lower-privileged users to perform high-privileged operations, such as deleting administrator accounts. This could lead to unauthorized data deletion or modification, potentially violating data integrity and access control requirements in standards like GDPR and HIPAA.

Mitigation Strategies

Update the XueZhiSi Open Source Exam System to a version higher than 3.9.0 where this vulnerability is fixed. If an update is not available, restrict teacher role permissions to prevent deletion of administrator accounts and implement proper authorization checks in the POST /api/teacher/user/delete/{id} endpoint.

Hi! I’m here to help you understand CVE-2026-75458. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70