CVE-2026-100878 Details
Description
A vulnerability was identified in zhistaredu StarTraining up to 3.8.1. Affected by this issue is the function SysUser.isAdmin of the file edu-common/src/main/java/com/edu/common/core/domain/entity/SysUser.java of the component authRole Endpoint. The manipulation of the argument userId/roleIds leads to authorization bypass. The attack is possible to be carried out remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
An authorization bypass vulnerability has been identified in zhistaredu StarTraining versions through 3.8.1. The issue arises in the SysUser.isAdmin function, located in the authRole endpoint. The vulnerability allows for improper authorization by manipulating the userId or roleIds arguments, enabling arbitrary role reassignment. This issue can be exploited remotely by any authenticated user with a low-privilege token.
To address this vulnerability, the isAdmin function should be modified to verify the actual admin flag. Additionally, the @PreAuthorize annotation should be enforced on the user role grant endpoint, and roleIds scope validation should be implemented.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 27, 2026CISA-ADP
Assessed Sep 28, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/ArrestX/startraining-advisories/blob/main/advisories/ST-VULN-004-idor-auth-role-privesc.md | [email protected] | AdvisoryExploitRemedy |
| https://vuldb.com/cve/CVE-2026-100878 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/submit/915510 | [email protected] | Issue TrackingPermission Required |
| https://vuldb.com/vuln/410808 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/vuln/410808/cti | [email protected] | Content Wall |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-285 | Improper Authorization | [email protected] |
| CWE-639 | Authorization Bypass Through User-Controlled Key | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| zhistaredu StarTraining | <= 3.8.1 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 28, 2026 | CVE Modified | CISA-ADP |
| Sep 27, 2026 | New CVE Received | [email protected] |