CVE-2026-75460

Deferred Deferred - Pending Action

Privilege Escalation in XueZhiSi Open Source Exam System

Publication date: 2026-08-31

Last updated on: 2026-09-01

Assigner: MITRE

Description

XueZhiSi Open Source Exam System <= 3.9.0 has a privilege escalation vulnerability in the teacher-end interface POST /api/teacher/user/page/list. The role parameter in UserPageRequestVM is fully controllable by the requester.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-31

Last Modified

2026-09-01

Generated

2026-09-21

AI Q&A

2026-09-01

EPSS Evaluated

2026-09-15

NVD

CVE-2026-75460

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-639	The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

Executive Summary

This vulnerability is a privilege escalation issue in XueZhiSi Open Source Exam System version 3.9.0 or lower. It allows an attacker to manipulate the role parameter in the teacher-end interface POST /api/teacher/user/page/list to gain unauthorized elevated privileges.

Detection Guidance

To detect this vulnerability, inspect HTTP POST requests to /api/teacher/user/page/list for a manipulable 'role' parameter in UserPageRequestVM. Check if the role parameter can be modified to escalate privileges. Use tools like curl to send test requests with varying role values and monitor responses for unauthorized access.

Impact Analysis

If exploited, this vulnerability could allow an attacker to escalate their privileges within the system, potentially accessing sensitive data, modifying exam results, or performing unauthorized actions that require higher-level permissions.

Compliance Impact

The vulnerability allows privilege escalation through uncontrolled role parameters, which could lead to unauthorized access to sensitive data. This may violate compliance requirements under GDPR (data protection) and HIPAA (healthcare data privacy) by enabling unauthorized data exposure or modification.

Mitigation Strategies

Upgrade XueZhiSi Open Source Exam System to a version higher than 3.9.0 to address the privilege escalation vulnerability in the teacher-end interface.

Hi! I’m here to help you understand CVE-2026-75460. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70