CVE-2026-90851
Received Received - Intake

Improper Access Control in PHPGurukul Hostel Management System

Publication date: 2026-09-15

Last updated on: 2026-09-15

Assigner: VulDB

Description
A flaw has been found in PHPGurukul Hostel Management System 3.0. This affects an unknown part of the file /admin/includes/checklogin.php. This manipulation of the argument ID causes improper access controls. Remote exploitation of the attack is possible. The exploit has been published and may be used.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-15
Last Modified
2026-09-15
Generated
2026-09-15
AI Q&A
2026-09-15
EPSS Evaluated
N/A
NVD
CVE-2026-90851
EUVD
EUVD-2026-78253

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
phpgurukul hostel_management_system 3.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-266 A product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor.
CWE-284 The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a Broken Access Control flaw in PHPGurukul Hostel Management System 3.0. It allows authenticated students to access administrative functions due to improper session handling. The system uses a single session identifier for all users, assigning the same $_SESSION['id'] regardless of role. Authorization checks only verify if the session ID is non-empty, not the user's role.

Detection Guidance

Check for unauthorized access to administrative pages like /admin/dashboard.php, /admin/manage-students.php, /admin/manage-rooms.php, or /admin/manage-courses.php by non-admin users. Inspect session handling in /admin/includes/checklogin.php to see if $_SESSION['id'] is used for both students and admins without role separation.

Impact Analysis

If exploited, this vulnerability enables authenticated students to view, modify, or delete sensitive administrative records. This includes student registrations, room allocations, courses, and user logs. Attackers could manipulate data, disrupt operations, or gain unauthorized access to confidential information.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR and HIPAA due to unauthorized access and potential exposure of sensitive personal data. GDPR requires strict access controls and data protection, while HIPAA mandates safeguards for protected health information. The flaw violates these requirements by allowing unauthorized role-based access.

Mitigation Strategies

Implement role-based session separation by using distinct session variables for students and admins. Add explicit role checks on all administrative pages to verify user permissions before granting access. Update authorization logic to validate user roles, not just session existence.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-90851. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart