CVE-2026-75458: XueZhiSi Exam System Privilege Escalation

CVE-2026-75458 Overview

CVE-2026-75458 is a vertical privilege escalation vulnerability in the XueZhiSi (xzs) Open Source Exam System versions 3.9.0 and earlier. The flaw resides in the teacher-end endpoint POST /api/teacher/user/delete/{id}, which fails to verify whether the authenticated caller has authority over the target account. An authenticated teacher user (role=2) can invoke the endpoint against an administrator account (role=3) and mark it deleted. This defect is classified under CWE-639: Authorization Bypass Through User-Controlled Key.

Critical Impact
A low-privileged teacher account can delete administrator accounts, disrupting platform governance and enabling takeover of the exam system.

Affected Products

XueZhiSi (xzs) Open Source Exam System versions <= 3.9.0
Teacher-end REST API component (/api/teacher/user/delete/{id})
User management service invoking getUserById, setDeleted, updateByIdFilter

Discovery Timeline

2026-08-31 - CVE-2026-75458 published to NVD
2026-09-01 - Last updated in NVD database

Technical Details for CVE-2026-75458

Vulnerability Analysis

The XueZhiSi exam system exposes a teacher-scoped user deletion endpoint that accepts a numeric user identifier in the URL path. Upon receiving a request, the controller sequentially calls getUserById(id), setDeleted(true), and updateByIdFilter() to soft-delete the target account. The code path performs no comparison between the authenticated principal's role and the role of the resource being modified. As a result, the authorization boundary between teacher (role=2) and administrator (role=3) collapses at this endpoint.

An attacker who holds any valid teacher session can enumerate or guess administrator user IDs and issue delete requests against them. Removal of administrator accounts destroys legitimate oversight, blocks recovery workflows, and can be chained with additional teacher-scoped functions to further degrade platform integrity. The vulnerability affects data integrity and availability but does not directly expose confidential data.

Root Cause

The root cause is missing object-level authorization on the user deletion handler. The service trusts the URL-supplied id parameter and processes it without evaluating the relationship between the caller's role and the target user's role. This is a canonical CWE-639 pattern in which access decisions rely solely on authentication rather than on per-object authorization checks.

Attack Vector

Exploitation requires network reachability to the teacher API and a valid teacher credential. The attacker authenticates as a teacher, obtains a session token, and issues a POST request to /api/teacher/user/delete/{id} where {id} corresponds to an administrator account. The backend sets the deleted flag on the administrator row without an authorization check. No user interaction from the victim is required. See the GitHub patch comparison for the fix diff.

Detection Methods for CVE-2026-75458

Indicators of Compromise

Requests to POST /api/teacher/user/delete/{id} where {id} resolves to an account with role=3 (administrator).
Unexpected deleted=true state on administrator rows in the user table without a corresponding administrative action log.
Authentication sessions belonging to teacher accounts (role=2) issuing user-management API calls outside their normal working set.

Detection Strategies

Instrument the deletion controller to log the caller role, target role, and target ID for every invocation, then alert when the target role exceeds the caller role.
Deploy a WAF or API gateway rule that inspects the resolved target user's role before forwarding delete requests to the backend.
Correlate soft-delete database mutations on privileged accounts with the originating HTTP session and role at the SIEM layer.

Monitoring Recommendations

Enable audit logging on all /api/teacher/** and /api/admin/** user-management routes and forward the events to a centralized SIEM.
Alert on any change to administrator account state initiated from a non-administrator session.
Baseline normal teacher API activity and flag deviations such as user deletion volume spikes or access to unfamiliar user IDs.

How to Mitigate CVE-2026-75458

Immediate Actions Required

Apply the upstream fix from the GitHub patch comparison that adds authorization checks to the teacher deletion path.
Restrict access to /api/teacher/user/delete/{id} at the reverse proxy until the patch is deployed.
Audit the user table for administrator accounts marked deleted=true and restore any illegitimate soft-deletions.
Rotate credentials and invalidate active sessions for all teacher accounts after remediation.

Patch Information

A community patch is available in the branch referenced by the GitHub patch comparison. The fix introduces an authorization check that validates the caller's role against the target user's role before executing the soft-delete flow. Operators running XueZhiSi 3.9.0 or earlier should merge the patch or upgrade to a version that incorporates it.

Workarounds

Enforce server-side role comparison in the deletion handler: reject the request when the target user's role is greater than or equal to the caller's role.
Block POST /api/teacher/user/delete/{id} at the API gateway for all teacher-scoped tokens until the patch is applied.
Migrate destructive user-management operations behind an administrator-only route and remove them from the teacher API surface.

bash

# Example reverse-proxy block (nginx) to disable the vulnerable route pre-patch
location ~ ^/api/teacher/user/delete/ {
    return 403;
}