CVE-2026-75460: XueZhiSi Exam System Privilege Escalation

CVE-2026-75460 Overview

CVE-2026-75460 is a privilege escalation vulnerability in XueZhiSi Open Source Exam System versions 3.9.0 and earlier. The flaw exists in the teacher-end interface endpoint POST /api/teacher/user/page/list. The role parameter within the UserPageRequestVM object is fully controllable by the requester. An authenticated teacher account can manipulate this parameter to access user records outside its assigned authorization scope. The vulnerability is categorized under [CWE-639] Authorization Bypass Through User-Controlled Key.

Critical Impact
Authenticated users with teacher-level access can escalate privileges by tampering with the role parameter, exposing user data intended for higher-privileged roles.

Affected Products

XueZhiSi Open Source Exam System versions <= 3.9.0
The xzs project maintained on GitHub by mindskip
Deployments exposing the /api/teacher/user/page/list endpoint

Discovery Timeline

2026-08-31 - CVE-2026-75460 published to the National Vulnerability Database (NVD)
2026-09-01 - Last updated in NVD database

Technical Details for CVE-2026-75460

Vulnerability Analysis

The XueZhiSi exam platform exposes a paginated user listing endpoint under the teacher API namespace. The controller accepts a UserPageRequestVM payload that includes a role field used to filter which user records are returned. The server-side handler trusts this client-supplied value without validating whether the authenticated caller is permitted to query the requested role. A teacher account can therefore submit requests referencing administrative or student roles and receive corresponding records.

This is a broken access control condition rather than an authentication weakness. Session validation succeeds, but the authorization layer fails to constrain the caller to their own role scope. The impact is limited to confidentiality: attackers gain read access to user data associated with other roles, but the CVSS vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N indicates no direct integrity or availability effect.

Root Cause

The root cause is an insecure direct object reference on the role parameter in UserPageRequestVM. The handler for POST /api/teacher/user/page/list uses the parameter to build the query filter but never cross-references it against the authenticated principal's role assignment. Server-side authorization checks should override any client-supplied role value.

Attack Vector

An attacker requires a valid teacher account. The attacker sends a crafted POST request to /api/teacher/user/page/list and sets the role field in the JSON body to a value representing a higher-privileged role. The API returns user records matching that role, including potentially sensitive identity data. Refer to the GitHub Patch Comparison for the corrective diff illustrating how the parameter should be constrained server-side.

Detection Methods for CVE-2026-75460

Indicators of Compromise

Requests to POST /api/teacher/user/page/list where the JSON body role field does not match the caller's assigned role.
Unexpected volumes of paginated user-list queries originating from a single teacher session.
Application log entries showing administrator or student user records returned to teacher-role sessions.

Detection Strategies

Inspect application access logs for role values in UserPageRequestVM payloads and correlate them with the session's authenticated role claim.
Deploy web application firewall rules that flag mismatches between JWT or session role claims and body parameters on teacher API routes.
Baseline normal query patterns for teacher accounts and alert on deviations that indicate enumeration of non-teacher records.

Monitoring Recommendations

Forward XueZhiSi application logs to a centralized analytics platform for cross-session correlation and retention.
Monitor authentication logs for teacher accounts followed by bulk read operations against user listing endpoints.
Track outbound response sizes on /api/teacher/user/* endpoints to detect abnormal data exfiltration patterns.

How to Mitigate CVE-2026-75460

Immediate Actions Required

Apply the upstream patch referenced in the GitHub Patch Comparison to enforce server-side role validation.
Audit existing teacher accounts and rotate credentials for any accounts showing suspicious role parameter usage.
Restrict network exposure of the XueZhiSi application to trusted networks until the patch is deployed.

Patch Information

The upstream project mindskip/xzs has a proposed patch documented in a GitHub compare view. The corrective change constrains the role filter server-side rather than accepting the client-supplied value. Administrators running versions <= 3.9.0 should merge the patch into their deployment or upgrade to a release that incorporates the fix. Verify build integrity after applying the change.

Workarounds

Implement a reverse-proxy rule that strips or rewrites the role field on requests to /api/teacher/user/page/list.
Temporarily disable the teacher user-listing endpoint if it is not required for operations.
Apply role-based access control at an API gateway layer to enforce the caller's authorized role against request bodies.

bash

# Example nginx rule to block requests where role is user-supplied
location /api/teacher/user/page/list {
    if ($request_method = POST) {
        set $block 0;
        if ($request_body ~* "\"role\"\s*:") { set $block 1; }
        if ($block = 1) { return 403; }
    }
    proxy_pass http://xzs_backend;
}