CVE-2026-97879

Deferred Deferred - Pending Action

Authentication Bypass in StarTraining API Endpoint

Publication date: 2026-09-25

Last updated on: 2026-09-28

Assigner: VulDB

Description

A security flaw has been discovered in zhistaredu StarTraining up to 3.8.1. The affected element is an unknown function of the file SecurityConfig.java of the component api-docs Endpoint. Performing a manipulation results in missing authentication. It is possible to initiate the attack remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-25

Last Modified

2026-09-28

Generated

2026-10-16

AI Q&A

2026-09-25

EPSS Evaluated

2026-10-14

NVD

CVE-2026-97879

EUVD

EUVD-2026-87202

Affected Vendors & Products

Vendor	Product	Version / Range
zhistaredu	startraining	to 3.8.1 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-306	The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
CWE-287	When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Attack-Flow Graph

Executive Summary

This vulnerability is a missing authentication flaw in the StarTraining software up to version 3.8.1. It exists in the SecurityConfig.java file of the api-docs Endpoint component. An attacker can remotely exploit this to bypass authentication and access restricted functionality without proper credentials.

Detection Guidance

This vulnerability involves missing authentication in the zhistaredu StarTraining API-docs endpoint due to an issue in SecurityConfig.java. To detect it, inspect network traffic for unauthenticated requests to the /api-docs endpoint or check server logs for unusual access patterns without valid credentials.

Impact Analysis

An attacker could exploit this to gain unauthorized access to sensitive data or administrative functions in the StarTraining system. Since the exploit is publicly available, the risk of attack is higher. The impact includes potential data breaches or unauthorized system modifications.

Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive data, violating GDPR and HIPAA requirements for data protection and access controls. Non-compliance may result in legal penalties, fines, or reputational damage.

Mitigation Strategies

Immediately restrict access to the api-docs Endpoint in SecurityConfig.java. Disable or remove the affected component if possible. Monitor network traffic for unauthorized access attempts to this endpoint. Apply network-level controls to block external requests to the vulnerable path.

Hi! I’m here to help you understand CVE-2026-97879. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70