CVE-2026-90851 Details

A broken access control vulnerability has been identified in PHPGurukul Hostel Management System version 3.0. The issue resides in the file '/admin/includes/checklogin.php', where the authorization mechanism fails to properly validate user roles. This flaw allows authenticated student accounts to access administrative functionalities remotely. The vulnerability arises because both student and administrator logins share the same session identifier for user IDs, enabling students to bypass admin restrictions and exploit administrative features.

To address this vulnerability, implement separate session namespaces for student and admin logins, enforce role checks on all administrative pages, and conduct a thorough authorization audit of the admin section to ensure proper access controls are in place.