CVE-2026-86214

Deferred Deferred - Pending Action

BaseFortify

Publication date: 2026-09-06

Last updated on: 2026-09-08

Assigner: VulDB

Description

A vulnerability was determined in Mstfakts College-Management-System. Impacted is an unknown function of the file Front-end/login.php. This manipulation of the argument email causes improper authentication. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-06

Last Modified

2026-09-08

Generated

2026-10-17

AI Q&A

2026-09-06

EPSS Evaluated

2026-10-14

NVD

CVE-2026-86214

EUVD

EUVD-2026-72128

Affected Vendors & Products

Vendor	Product	Version / Range
n/a	Mstfakts	College-Management-System 82ab01d057d96c8893c419cd9cb6870120faaea3
n/a	Mstfakts	College-Management-System a37300648b6e50d43a2f10392ad741d199635daf
n/a	Mstfakts	College-Management-System c81bbedea4d9e0b860ac368aa1dbb10e55ceddce

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-287	When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Attack-Flow Graph

Executive Summary

This vulnerability is an improper authentication issue in the College Management System where an attacker can claim pre-provisioned student or lecturer identities by registering an email that matches an existing identity in the system without verifying email ownership. The system links login records to business identities solely by email, allowing unauthorized access to sensitive data and the ability to modify information.

Detection Guidance

Check if the College Management System's login.php allows registration with arbitrary emails without verification. Inspect the registration flow for missing email ownership validation. Test by attempting to register with an email matching a pre-provisioned identity in student or lecturer tables.

Impact Analysis

An attacker could gain unauthorized access to personal and academic records, view or alter sensitive data such as club memberships, and perform actions under the claimed identity. This could lead to data breaches, identity theft, or unauthorized modifications to academic information.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR and HIPAA due to unauthorized access to personal and sensitive data. GDPR requires protecting personal data, while HIPAA mandates safeguarding health-related information. A breach could result in legal penalties, fines, and reputational damage.

Mitigation Strategies

Implement email verification during registration to confirm ownership. Bind account creation to server-side enrollment records instead of relying on user-supplied emails. Restrict access to sensitive data until verification is complete.

Hi! I’m here to help you understand CVE-2026-86214. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70