CVE-2026-82553
Received Received - Intake

Improper Authorization in Student Management System

Publication date: 2026-08-30

Last updated on: 2026-08-30

Assigner: VulDB

Description
A vulnerability was detected in sambitraj Student Management System up to 56ba287f2e9031523ccb4244cb6e3fe530e4e5d5. Affected by this issue is the function mysqli_query of the file student_dashboard.php of the component Student Dashboard. The manipulation of the argument roll_no results in improper authorization. The attack may be performed from remote. The exploit is now public and may be used. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed. The project was informed of the problem early through an issue report but has not responded yet.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-30
Last Modified
2026-08-30
Generated
2026-08-30
AI Q&A
2026-08-30
EPSS Evaluated
N/A
NVD
CVE-2026-82553
EUVD
EUVD-2026-68279

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
sambitraj student_management_system 56ba287f2e9031523ccb4244cb6e3fe530e4e5d5

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-285 The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.
CWE-266 A product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an Insecure Direct Object Reference (IDOR) flaw in the Student Management System. It allows authenticated students to access other students' sensitive data by manipulating the roll_no parameter in the student_dashboard.php file. The system fails to verify if the requested record belongs to the logged-in student, enabling unauthorized access to profiles, passwords, and academic results.

Detection Guidance

To detect this IDOR vulnerability, monitor HTTP requests to student_dashboard.php for roll_no parameter manipulation. Check if different roll numbers return unauthorized data. Use tools like Burp Suite to intercept and modify roll_no values during authenticated sessions. Inspect application logs for repeated access attempts to other students' records.

Impact Analysis

If you are a student using this system, an attacker with a valid student account could access your personal data, including email, password, academic records, and other sensitive information. This could lead to identity theft, academic fraud, or privacy violations.

Compliance Impact

This vulnerability likely violates data protection regulations such as GDPR and HIPAA by exposing personal and sensitive student data without proper authorization. It could result in legal penalties, loss of trust, and reputational damage for institutions using the affected system.

Mitigation Strategies

Immediately restrict direct roll_no parameter access in student_dashboard.php. Implement session-based ownership checks to verify users can only access their own data. Add row-level access controls in the database query to enforce authorization. Temporarily disable the student dashboard if a patch is unavailable.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-82553. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart