CVE-2026-14719: Online Examination System Privilege Escalation

CVE-2026-14719 Overview

CVE-2026-14719 is an improper privilege management vulnerability [CWE-266] affecting SourceCodester Online Examination & Learning Management System version 1.0. The flaw resides in the register.php file within the Registration Endpoint component. Attackers can manipulate the role argument during registration to assign themselves elevated privileges. The vulnerability is exploitable remotely without authentication or user interaction. A public exploit has been published, increasing the risk of opportunistic attacks against exposed installations.

Critical Impact
Unauthenticated remote attackers can register accounts with elevated privileges by tampering with the role parameter, leading to unauthorized administrative access.

Affected Products

SourceCodester Online Examination & Learning Management System 1.0
Component: Registration Endpoint (register.php)
Deployments exposing the registration function to untrusted networks

Discovery Timeline

2026-07-05 - CVE-2026-14719 published to NVD
2026-07-06 - Last updated in NVD database

Technical Details for CVE-2026-14719

Vulnerability Analysis

The vulnerability stems from the registration handler trusting a client-supplied role parameter when creating user accounts. The register.php endpoint accepts the role designation directly from the HTTP request body without server-side validation or enforcement. Attackers can submit a registration request that specifies an administrator role, bypassing the intended separation between student, instructor, and administrative accounts. This is a classic mass assignment pattern where sensitive account attributes are exposed to user-controlled input.

Root Cause

The root cause is improper privilege management [CWE-266]. The application assigns account roles based on unvalidated request parameters rather than server-controlled logic. There is no allowlist check restricting registration to non-privileged roles, and no authorization step verifying that a caller may request elevated privileges. Any HTTP client capable of reaching the registration endpoint can define its own privilege level.

Attack Vector

Exploitation requires network access to the registration page and no prior authentication. An attacker submits a crafted HTTP POST to register.php with the role field set to a privileged value such as admin. Upon successful registration, the attacker authenticates with the newly created privileged account and gains administrative access to the application. Because the exploit has been publicly disclosed, automated scanning against exposed instances is likely.

No verified proof-of-concept code is republished here. Technical details are referenced in the VulDB entry for CVE-2026-14719 and the associated VulDB vulnerability record.

Detection Methods for CVE-2026-14719

Indicators of Compromise

HTTP POST requests to /register.php containing a role parameter with values such as admin, administrator, or numeric identifiers indicating elevated tiers.
New user accounts created with administrative privileges outside of change-management windows.
Successful authentication events from accounts created within minutes of a suspicious registration request.

Detection Strategies

Inspect web server access logs for POST requests to register.php and parse the request body for the presence of a role field.
Correlate registration events with subsequent privileged actions such as user management, content modification, or configuration changes.
Alert when the account role assigned at creation deviates from the default student role produced by the standard registration form.

Monitoring Recommendations

Enable verbose logging on the application database to capture INSERT statements against the users table, including the assigned role column.
Deploy a web application firewall rule that flags or blocks registration requests containing a role parameter.
Review privileged account inventories on a recurring basis to identify accounts that were not provisioned through administrative workflows.

How to Mitigate CVE-2026-14719

Immediate Actions Required

Restrict network access to the registration endpoint using firewall rules or authentication gateways until a fix is applied.
Audit all existing accounts and remove or downgrade any accounts not created through approved administrative processes.
Rotate credentials for legitimate administrator accounts in case attackers observed authenticated sessions.

Patch Information

No official vendor patch has been published for CVE-2026-14719 at the time of NVD publication. Operators should modify register.php to hardcode the default role on the server side and ignore any client-supplied role parameter. Any privilege elevation should occur through an authenticated administrative workflow that enforces authorization checks.

Workarounds

Remove the role field from registration form processing and set the role to the least-privileged value in server-side code.
Place the registration endpoint behind an invitation or approval flow so that new accounts require administrative confirmation before activation.
If registration is not required, disable register.php entirely by removing the file or blocking it at the web server configuration level.

bash

# Example: block direct access to register.php via Apache configuration
<Files "register.php">
    Require all denied
</Files>