CVE-2026-86214 Details

An improper authentication vulnerability has been identified in Mstfakts College Management System, specifically in the login.php file. The issue arises from an unverified registration process that allows users to claim pre-provisioned student and lecturer identities by simply providing an email address. This vulnerability can be exploited remotely, as the application does not verify email ownership before account creation. The problem has been publicly disclosed, and the project has not yet responded to reports of the issue.

To address this vulnerability, implement an email verification step before activating accounts and ensure that registration is tied to a server-side, single-use enrollment record. This process should verify ownership of the email and the right to claim associated identities. Access to 'student' or 'lecturer' data should be restricted until the verification and binding process is complete.