CVE-2026-14778: SourceCodester LMS Auth Bypass Flaw

CVE-2026-14778 Overview

CVE-2026-14778 is an improper authorization vulnerability in SourceCodester Online Examination & Learning Management System 1.0. The flaw resides in the /ajax_enroll.php endpoint within the Enrollment Management component. Attackers can manipulate the student_id, schedule_id, or action parameters to perform actions on behalf of other users without proper authorization checks. The issue is classified under [CWE-266: Incorrect Privilege Assignment] and represents an Insecure Direct Object Reference (IDOR) condition. Remote exploitation is possible over the network, and public disclosure of the exploit technique has already occurred.

Critical Impact
Unauthenticated remote attackers can enroll, modify, or drop enrollments belonging to other students by tampering with request parameters against the vulnerable endpoint.

Affected Products

SourceCodester Online Examination & Learning Management System 1.0
Component: Enrollment Management (/ajax_enroll.php)
Deployments exposing the affected PHP endpoint to untrusted networks

Discovery Timeline

2026-07-06 - CVE-2026-14778 published to NVD
2026-07-06 - Last updated in NVD database

Technical Details for CVE-2026-14778

Vulnerability Analysis

The vulnerability lives in the /ajax_enroll.php handler, which processes enrollment operations for the learning management platform. The endpoint accepts three user-controlled parameters: student_id, schedule_id, and action. The server acts on those parameters without verifying that the requester owns the referenced student_id or holds sufficient privileges to invoke the requested action. This constitutes an Insecure Direct Object Reference (IDOR) and maps directly to [CWE-266]. Because the endpoint lacks server-side authorization, an attacker can iterate student_id values to affect any enrolled learner's record.

Root Cause

The root cause is missing authorization enforcement inside the AJAX enrollment handler. The application trusts client-supplied identifiers and does not cross-check them against the authenticated session, if any exists. Access decisions rely on parameter values alone rather than server-side identity, role, or ownership validation.

Attack Vector

Exploitation requires only network access to the vulnerable endpoint. An attacker crafts an HTTP request to /ajax_enroll.php with a targeted student_id, a chosen schedule_id, and an action value corresponding to enroll or drop operations. No authentication or user interaction is required to reach the endpoint. Technical write-up and reproduction steps are available in the GitHub IDOR Report and the VulDB CVE-2026-14778 entry.

Detection Methods for CVE-2026-14778

Indicators of Compromise

HTTP POST or GET requests to /ajax_enroll.php containing student_id, schedule_id, and action parameters from unauthenticated sessions.
Sequential or enumerated student_id values originating from a single client IP within a short time window.
Unexpected enrollment or drop entries in the LMS database that do not correspond to legitimate user activity.

Detection Strategies

Deploy web application firewall (WAF) rules that flag direct requests to /ajax_enroll.php lacking a valid authenticated session cookie.
Correlate application logs to detect one source IP acting against many distinct student_id values, a signature of IDOR enumeration.
Baseline normal enrollment volumes per user and alert on deviations such as bulk enrollments outside registration windows.

Monitoring Recommendations

Enable verbose access logging on the PHP application server and forward logs to a centralized analytics platform for retention and querying.
Monitor the enrollment database table for inserts, updates, or deletes that lack a matching authenticated user context.
Alert on HTTP 200 responses returned from /ajax_enroll.php when the request originates from an unauthenticated session.

How to Mitigate CVE-2026-14778

Immediate Actions Required

Restrict network access to the Online Examination & Learning Management System until an authorization fix is applied, using firewall rules or an authenticated reverse proxy.
Disable or remove the /ajax_enroll.php endpoint if enrollment functionality is not actively required in production.
Review recent enrollment records for unauthorized changes and revert unauthorized modifications.

Patch Information

At the time of publication, SourceCodester has not released an official patch for CVE-2026-14778. Administrators should monitor SourceCodester Resources and the VulDB Vulnerability #376368 entry for updates. Because the affected product is a distributed PHP source package, operators must apply code-level fixes locally by adding server-side ownership and role checks to the enrollment handler.

Workarounds

Add server-side authorization in ajax_enroll.php that validates the session user owns the submitted student_id before processing any action.
Enforce role-based access control so that only authenticated students can modify their own enrollments and only administrators can modify others.
Implement anti-automation controls such as rate limiting and CSRF tokens on enrollment endpoints to hinder mass exploitation.
Log every invocation of the enrollment endpoint with source IP, session identifier, and parameter values for forensic review.

bash

# Example nginx configuration to require authentication before reaching the endpoint
location = /ajax_enroll.php {
    auth_request /auth-check;
    limit_req zone=enroll burst=5 nodelay;
    proxy_pass http://php-backend;
}

location = /auth-check {
    internal;
    proxy_pass http://auth-service/validate;
    proxy_pass_request_body off;
    proxy_set_header Content-Length "";
    proxy_set_header X-Original-URI $request_uri;
}