CVE-2026-86214
Received Received - Intake

Authentication Bypass in Mstfakts College Management System

Publication date: 2026-09-06

Last updated on: 2026-09-06

Assigner: VulDB

Description
A vulnerability was determined in Mstfakts College-Management-System. Impacted is an unknown function of the file Front-end/login.php. This manipulation of the argument email causes improper authentication. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-06
Last Modified
2026-09-06
Generated
2026-09-06
AI Q&A
2026-09-06
EPSS Evaluated
N/A
NVD
CVE-2026-86214
EUVD
EUVD-2026-72128

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-287 When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an improper authentication issue in the College Management System where an attacker can claim pre-provisioned student or lecturer identities by registering an email that matches an existing identity in the system without verifying email ownership. The system links login records to business identities solely by email, allowing unauthorized access to sensitive data and the ability to modify information.

Detection Guidance

Check if the College Management System's login.php allows registration with arbitrary emails without verification. Inspect the registration flow for missing email ownership validation. Test by attempting to register with an email matching a pre-provisioned identity in student or lecturer tables.

Impact Analysis

An attacker could gain unauthorized access to personal and academic records, view or alter sensitive data such as club memberships, and perform actions under the claimed identity. This could lead to data breaches, identity theft, or unauthorized modifications to academic information.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR and HIPAA due to unauthorized access to personal and sensitive data. GDPR requires protecting personal data, while HIPAA mandates safeguarding health-related information. A breach could result in legal penalties, fines, and reputational damage.

Mitigation Strategies

Implement email verification during registration to confirm ownership. Bind account creation to server-side enrollment records instead of relying on user-supplied emails. Restrict access to sensitive data until verification is complete.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-86214. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart