CVE-2026-35610: PolarLearn Privilege Escalation Flaw

CVE-2026-35610 Overview

PolarLearn is a free and open-source learning program that contains a critical privilege escalation vulnerability in its account-management module. In version 0-PRERELEASE-14 and earlier, the setCustomPassword(userId, password) and deleteUser(userId) functions use an inverted admin check condition. This logic error allows authenticated non-admin users to execute privileged administrative actions, while legitimate administrators are incorrectly rejected from performing these operations.

Critical Impact

Authenticated non-admin users can change any user's password and delete arbitrary user accounts, enabling complete account takeover and denial of service through unauthorized account deletion.

Affected Products

• PolarLearn version 0-PRERELEASE-14 and earlier
• PolarLearn account-management module

Discovery Timeline

• 2026-04-07 - CVE CVE-2026-35610 published to NVD
• 2026-04-08 - Last updated in NVD database

Technical Details for CVE-2026-35610

Vulnerability Analysis

This vulnerability is classified under CWE-285 (Improper Authorization), which describes situations where an application fails to properly enforce authorization checks before granting access to protected resources or functionality. The flaw exists in the account-management module where the authorization logic condition is inverted, effectively reversing the intended access control policy.

The vulnerable functions setCustomPassword(userId, password) and deleteUser(userId) are designed to be administrative operations that should only be accessible to users with admin privileges. However, due to the inverted condition check, the authorization logic grants access to non-admin users while denying access to actual administrators. This represents a complete failure of the access control mechanism for these critical account management functions.

Root Cause

The root cause is an inverted boolean condition in the admin privilege check within the account-management module. Rather than verifying that a user has admin privileges before allowing execution, the logic incorrectly checks if the user does NOT have admin privileges, causing the authorization to be granted to the wrong set of users.

Attack Vector

The attack vector is network-based and requires low privileges to exploit. An attacker needs only an authenticated session with a non-admin account to exploit this vulnerability. Once authenticated, the attacker can:

1. Call the setCustomPassword(userId, password) function with any target user's ID to change their password, including administrator accounts
2. Call the deleteUser(userId) function to delete any user account in the system
3. Achieve full account takeover by resetting administrator passwords and gaining elevated access

The exploitation does not require user interaction, making it straightforward for any authenticated user to exploit. The vulnerability enables both horizontal privilege escalation (accessing other users' accounts) and vertical privilege escalation (gaining admin access by resetting admin passwords).

Detection Methods for CVE-2026-35610

Indicators of Compromise

• Password change operations initiated by non-admin user accounts targeting other users
• Unexpected user deletion events in application logs from non-administrative sessions
• Admin accounts experiencing unexplained password resets or lockouts
• Anomalous spikes in account-management API calls from low-privilege users

Detection Strategies

• Audit application logs for setCustomPassword and deleteUser function calls and correlate with the privilege level of the calling user
• Implement anomaly detection for password change patterns, particularly when the requester ID differs from the target user ID
• Monitor for bulk user deletion events that may indicate malicious activity
• Review authentication logs for admin accounts to detect unauthorized access following potential password changes

Monitoring Recommendations

• Enable verbose logging for all account-management module operations
• Set up alerts for administrative function calls from non-admin session contexts
• Implement real-time monitoring of user account modifications and deletions
• Establish baseline metrics for normal account management activity to identify deviations

How to Mitigate CVE-2026-35610

Immediate Actions Required

• Upgrade PolarLearn to a patched version that addresses the inverted admin check
• Audit all recent account modifications and deletions to identify potential exploitation
• Reset passwords for all administrator accounts as a precautionary measure
• Review user account integrity and restore any improperly deleted accounts from backups

Patch Information

Refer to the GitHub Security Advisory for official patch information and updated versions. Users running version 0-PRERELEASE-14 or earlier should upgrade to the latest release that contains the security fix for the inverted admin check.

Workarounds

• Restrict network access to the PolarLearn application to trusted users only until a patch can be applied
• Implement additional authentication requirements at the network or reverse proxy level for administrative functions
• Disable or restrict the account-management module if the functionality is not critical to operations
• Deploy a web application firewall (WAF) rule to block or monitor requests to the affected endpoints

If patching is not immediately possible, consider implementing a temporary fix by reviewing and correcting the admin check logic in the account-management module. The inverted condition should be corrected to properly verify admin privileges before allowing execution of setCustomPassword and deleteUser functions.