CVE-2026-12529: CET Grading System Auth Bypass Flaw

CVE-2026-12529 Overview

CVE-2026-12529 is an improper access control vulnerability in SourceCodester CET Automated Grading System with AI Predictive Analytics 1.0. The flaw resides in an unknown function within /index.php, part of the Student Self-Registration Endpoint. Attackers can exploit this weakness remotely without authentication or user interaction. The vulnerability is categorized under [CWE-266] (Incorrect Privilege Assignment) and affects the confidentiality, integrity, and availability of the application at a limited scope.

Critical Impact
Remote attackers can abuse the student self-registration endpoint to bypass access restrictions, potentially gaining unauthorized account privileges within the grading system.

Affected Products

SourceCodester CET Automated Grading System with AI Predictive Analytics 1.0
Component: Student Self-Registration Endpoint (/index.php)
Deployments running the unpatched 1.0 release

Discovery Timeline

2026-06-17 - CVE-2026-12529 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2026-12529

Vulnerability Analysis

The vulnerability stems from improper access controls in the student self-registration workflow exposed through /index.php. The endpoint fails to enforce server-side privilege boundaries when processing registration requests. As a result, an unauthenticated attacker can manipulate request parameters to register accounts with elevated or unintended roles. The flaw maps to [CWE-266], where the application assigns privileges incorrectly during account creation.

The EPSS probability for this CVE is 0.284% with a percentile of 19.94, indicating a low predicted likelihood of exploitation in the short term. No public proof-of-concept exploit is currently listed in Exploit-DB or CISA KEV. However, SourceCodester applications are frequently targeted in opportunistic scans due to their use in academic and small-business environments.

Root Cause

The root cause is missing or insufficient authorization logic in the self-registration handler. The application trusts client-supplied data when determining account roles or visibility scopes. Without enforced role validation on the server side, attackers can submit crafted POST data to assume privileges normally reserved for administrators or instructors.

Attack Vector

Exploitation occurs over the network against an exposed /index.php endpoint. No credentials or user interaction are required. An attacker submits a tampered registration request that includes parameters controlling role assignment or access scope. The server processes the request without validating whether the requester is authorized to set those values, granting the attacker an account with unintended privileges.

For technical details, refer to the VulDB CVE-2026-12529 entry and the VulDB Vulnerability #371976 record.

Detection Methods for CVE-2026-12529

Indicators of Compromise

Unexpected new accounts in the grading system database with administrator or instructor roles created via the public registration page.
POST requests to /index.php containing role, privilege, or user_type parameters originating from external IP addresses.
Login activity from newly registered accounts immediately followed by access to administrative or grading functions.

Detection Strategies

Inspect web server access logs for anomalous parameter sets in registration requests, especially fields not present in the standard student registration form.
Compare account role distributions over time. A sudden increase in privileged accounts created through the self-registration flow indicates abuse.
Deploy web application firewall rules that flag registration requests containing privilege-related parameters.

Monitoring Recommendations

Enable detailed PHP application logging for the registration handler and forward logs to a centralized analytics platform.
Alert on registration events that result in non-student role assignments.
Track failed and successful authentication attempts from accounts created during the suspected exposure window.

How to Mitigate CVE-2026-12529

Immediate Actions Required

Restrict access to /index.php registration functionality behind authentication or network controls until a vendor patch is available.
Audit all accounts created since deployment and remove any unauthorized privileged users.
Disable the self-registration feature if it is not strictly required for operations.

Patch Information

At the time of publication, no official patch has been released by SourceCodester for CET Automated Grading System with AI Predictive Analytics 1.0. Monitor the SourceCodester Security Resource and the VulDB CTI record for #371976 for vendor updates.

Workarounds

Implement server-side role validation that ignores client-supplied role or privilege parameters during registration.
Place the application behind a reverse proxy or WAF that filters registration requests for unexpected parameters.
Apply IP allowlisting to administrative interfaces and restrict the registration endpoint to trusted networks where feasible.

bash

# Example nginx rule blocking suspicious parameters on the registration endpoint
location = /index.php {
    if ($args ~* "(role|user_type|is_admin|privilege)=") {
        return 403;
    }
    proxy_pass http://backend;
}