CVE-2026-76999
Received Received - Intake

Improper Authorization in CET Automated Grading System with AI Predictive Analytics

Publication date: 2026-08-20

Last updated on: 2026-08-20

Assigner: VulDB

Description
A vulnerability was detected in SourceCodester CET Automated Grading System with AI Predictive Analytics 1.0. This affects the function add_grade of the file /index.php. Performing a manipulation of the argument student_id results in improper authorization. The attack can be initiated remotely.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-20
Last Modified
2026-08-20
Generated
2026-08-20
AI Q&A
2026-08-20
EPSS Evaluated
N/A
NVD
CVE-2026-76999
EUVD
EUVD-2026-63401

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
sourcecodester cet_automated_grading_system 1.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-266 A product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor.
CWE-285 The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability exists in SourceCodester CET Automated Grading System with AI Predictive Analytics 1.0. It allows improper authorization due to a flaw in the add_grade function of the file /index.php. An attacker can manipulate the student_id argument to gain unauthorized access or perform actions they shouldn't be able to.

Detection Guidance

To detect this vulnerability, monitor HTTP requests to /index.php for improper authorization attempts. Check for unusual student_id parameter manipulations in POST requests. Inspect server logs for unauthorized access patterns or anomalies in grade modification operations.

Impact Analysis

If exploited, this vulnerability could allow unauthorized users to modify grades or access sensitive student data. This could lead to incorrect academic records, privacy breaches, or unfair advantages in grading. The impact depends on the system's usage and data sensitivity.

Compliance Impact

This vulnerability could violate data protection regulations like GDPR or HIPAA by exposing or altering sensitive personal data. Improper authorization risks unauthorized access to student records, potentially leading to non-compliance with privacy requirements and legal penalties.

Mitigation Strategies

Immediately restrict access to /index.php by IP or implement WAF rules. Update the application to validate and sanitize the student_id parameter strictly. Apply least privilege principles to user roles and disable remote access if not required.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-76999. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart