CVE-2026-86275 Details

A vulnerability allowing unauthenticated privilege escalation has been identified in SourceCodester Syllabus-Aligned Learning Management and Examination System version 1.0. The issue arises in the registration function of the auth.php file, where the role parameter is accepted from user input without proper validation. This flaw enables remote exploitation, allowing attackers to register accounts with elevated privileges, such as super_admin, and gain full administrative control over the system.

The vulnerability can be addressed by implementing server-side validation of the role parameter in auth.php, ensuring that only authorized roles are accepted. Additionally, consider removing the open registration endpoint and requiring administrator approval for account creation.