CVE-2026-86215
Received Received - Intake

Session Expiration in Mstfakts College-Management-System

Publication date: 2026-09-06

Last updated on: 2026-09-06

Assigner: VulDB

Description
A vulnerability was identified in Mstfakts College-Management-System. The affected element is an unknown function of the file Front-end/server.php of the component Logout Handler. Such manipulation of the argument log_out leads to session expiration. It is possible to launch the attack remotely. The exploit is publicly available and might be used. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. The project was informed of the problem early through an issue report but has not responded yet.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-06
Last Modified
2026-09-06
Generated
2026-09-06
AI Q&A
2026-09-06
EPSS Evaluated
N/A
NVD
CVE-2026-86215
EUVD
EUVD-2026-72133

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-613 According to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization."

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is in the College Management System's logout function in server.php. Instead of properly ending a user's session, it only redirects to login.php without invalidating the session or expiring the session cookie. This leaves the session active, allowing others to access the user's data even after logout.

Detection Guidance

Check if the logout endpoint in server.php properly invalidates sessions by inspecting the response headers and cookies for session persistence after logout. Use browser developer tools to verify if the PHPSESSID cookie remains active or if session_destroy() is called. Monitor network traffic during logout to confirm redirection to login.php without session cleanup.

Impact Analysis

If you use this system, your session remains active after logging out. Anyone with access to your session cookie or shared device could access your personal data like email, birth date, GPA, and academic records without your permission.

Compliance Impact

This vulnerability likely violates data protection regulations like GDPR and HIPAA by failing to properly terminate user sessions. It exposes sensitive personal and academic data, which could lead to unauthorized access and non-compliance with privacy requirements.

Mitigation Strategies

Update the logout handler in server.php to include session_destroy() and clear the PHPSESSID cookie. Ensure the session is fully invalidated server-side before redirecting to login.php. Review and restrict access to session identifiers to prevent unauthorized reuse.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-86215. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart