CVE-2025-56747 Details

A privilege escalation vulnerability has been identified in Creativeitem Academy LMS versions through 5.13. The issue resides in the Api_instructor controller, where regular authenticated users can access instructor-only functions without proper role validation. This flaw enables unauthorized course creation and management.

The immediate fix is to add proper instructor role validation to all methods in the Api_instructor controller. This can be done by checking the 'is_instructor' flag in the user's database record before granting access to instructor-specific functions. Additionally, best practices such as implementing role-based access control consistently, using middleware for authorization checks, validating user permissions at the database level, and adding audit logging for privilege escalation attempts should be followed.