CVE-2026-14753: Stumasy Authorization Bypass Vulnerability

CVE-2026-14753 Overview

CVE-2026-14753 is an authorization bypass vulnerability in the mjperpinosa stumasy project, affecting commits up to 327d1b0f2915ba79d7ef8ebb74553e987609d9be. The flaw resides in the Note Handler and Assignment Handler component, specifically within the /PHP/objects/notes endpoint. Attackers can manipulate the assignment_item_id parameter to bypass authorization checks and access resources outside their permitted scope. The exploit is public and can be triggered remotely without authentication or user interaction. Because stumasy uses continuous delivery with rolling releases, no fixed version identifier is available. The project maintainer was notified through an issue report but has not responded.

Critical Impact
Remote, unauthenticated attackers can bypass authorization on the /PHP/objects/notes endpoint by tampering with assignment_item_id, exposing note and assignment data belonging to other users.

Affected Products

mjperpinosa stumasy — all commits up to 327d1b0f2915ba79d7ef8ebb74553e987609d9be
Component: Note Handler / Assignment Handler
Endpoint: /PHP/objects/notes

Discovery Timeline

2026-07-05 - CVE-2026-14753 published to NVD
2026-07-06 - Last updated in NVD database

Technical Details for CVE-2026-14753

Vulnerability Analysis

The vulnerability is an Improper Authorization weakness [CWE-285] in the stumasy student management PHP application. The /PHP/objects/notes handler accepts an assignment_item_id parameter that is used to read or operate on note and assignment records. The handler fails to verify that the authenticated session, if any, actually owns or has permission to access the referenced assignment_item_id. By substituting arbitrary identifier values, a remote attacker can retrieve or manipulate records that belong to other users.

Root Cause

The root cause is the absence of an authorization check tying the requesting principal to the requested object. The assignment_item_id argument is treated as a trusted lookup key, and the application returns results based solely on whether the record exists. This is a classic Insecure Direct Object Reference pattern layered on top of a missing authorization enforcement point.

Attack Vector

The attack is network-based and requires no privileges or user interaction. An attacker sends a crafted HTTP request to /PHP/objects/notes with a manipulated assignment_item_id value. The server processes the request and returns data associated with that identifier, regardless of ownership. Because the exploit is public, mass enumeration of numeric identifiers is expected. See the GitHub PoC Repository and the GitHub Issue Discussion for further technical context.

No verified exploit code is included here; refer to the VulDB Vulnerability Details for additional analysis.

Detection Methods for CVE-2026-14753

Indicators of Compromise

HTTP requests to /PHP/objects/notes containing sequential or scripted variations of the assignment_item_id parameter from a single source.
Access log entries showing successful 200 responses to /PHP/objects/notes from unauthenticated sessions or sessions that do not own the referenced item.
Sudden spikes in read volume against note or assignment records outside normal usage windows.

Detection Strategies

Instrument the application or a Web Application Firewall to log the tuple of session identity and assignment_item_id per request, then flag mismatches against ownership tables.
Deploy signature or behavioral rules that alert on identifier enumeration patterns targeting /PHP/objects/notes.
Correlate authentication events with object access events to surface anonymous or cross-tenant reads.

Monitoring Recommendations

Alert on repeated 200 OK responses to /PHP/objects/notes where the referenced assignment_item_id does not resolve to the requester.
Track baseline request rates to the endpoint and flag deviations that indicate scripted access.
Retain full HTTP request and response logs for the endpoint to support forensic reconstruction.

How to Mitigate CVE-2026-14753

Immediate Actions Required

Restrict network exposure of the stumasy deployment to trusted users until an authorization fix is applied.
Add a server-side authorization check that verifies the authenticated user owns the requested assignment_item_id before returning data.
Enable verbose access logging on /PHP/objects/notes and review logs for prior exploitation.

Patch Information

No official patch is available. The project uses continuous delivery with rolling releases and, per the CVE record, has not responded to the issue report. Operators should apply local code changes to enforce ownership checks in the note and assignment handlers, or fork the repository and maintain the fix internally. Monitor the GitHub PoC Repository for upstream activity.

Workarounds

Place the application behind an authenticating reverse proxy and block direct access to /PHP/objects/notes from untrusted networks.
Add a Web Application Firewall rule that requires an authenticated session cookie and validates the requester against the assignment_item_id mapping before proxying requests.
Rotate any sensitive data stored in notes or assignments and assume prior disclosure if the endpoint has been internet-exposed.

bash

# Example WAF-style pseudo-rule: deny unauthenticated access to the vulnerable endpoint
location = /PHP/objects/notes {
    if ($cookie_session = "") {
        return 403;
    }
    # Delegate ownership validation to an internal auth service
    auth_request /internal/authz-check;
    proxy_pass http://stumasy_backend;
}