Vertical Privilege Escalation in XueZhiSi Exam System

Publication date: 2026-08-31

Last updated on: 2026-08-31

Assigner: MITRE

Description

The teacher-end interface POST /api/teacher/user/delete/{id} in XueZhiSi Open Source Exam System <= 3.9.0 contains a vertical privilege escalatio vulnerability. This interface accepts a user ID and then executes getUserById(id), setDeleted(true), updateByIdFilter() in sequence, without any validation of whether the current user has the authority to delete the target user. An authenticated teacher user (role=2) can delete an administrator account (role=3), constituting a vertical privilege escalation where a lower-privileged user performs a high-privileged operation.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-31

Last Modified

2026-08-31

Generated

2026-09-01

AI Q&A

2026-09-01

EPSS Evaluated

N/A

NVD

CVE-2026-75458

Affected Vendors & Products

Vendor	Product	Version / Range
xuezisi	open_source_exam_system	to 3.9.0 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a vertical privilege escalation vulnerability in the XueZhiSi Open Source Exam System version 3.9.0 or earlier. An authenticated teacher user can delete administrator accounts by exploiting a flawed endpoint that lacks proper authorization checks.

Impact Analysis

If you are a teacher using this system, an attacker could exploit this to delete administrator accounts, disrupting system management and potentially causing data loss or service disruption.

Mitigation Strategies

Update the XueZhiSi Open Source Exam System to a version higher than 3.9.0 where this vulnerability is fixed. If an update is not available, restrict teacher role permissions to prevent deletion of administrator accounts and implement proper authorization checks in the POST /api/teacher/user/delete/{id} endpoint.

Hi! I’m here to help you understand CVE-2026-75458. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70