CVE-2026-86275: SourceCodester LMS Privilege Escalation

CVE-2026-86275 Overview

CVE-2026-86275 is an improper privilege management vulnerability [CWE-266] in SourceCodester Syllabus-Aligned Learning Management & Examination System 1.0. The flaw resides in the register function of auth.php, where manipulation of the role parameter allows an unauthenticated attacker to self-assign elevated privileges during account registration. Remote exploitation is possible over the network without authentication or user interaction. Public exploit details have been published, increasing the likelihood of opportunistic abuse against exposed deployments.

Critical Impact
Unauthenticated remote attackers can create accounts with administrative privileges, undermining the access control model of the learning management platform.

Affected Products

SourceCodester Syllabus-Aligned Learning Management & Examination System 1.0
Vulnerable component: auth.php (register function)
Vulnerable parameter: role

Discovery Timeline

2026-09-07 - CVE-2026-86275 published to NVD
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-86275

Vulnerability Analysis

The vulnerability exists in the registration workflow implemented in auth.php. The register function accepts a role argument from the client-supplied request and persists it into the user record without server-side validation or authorization. Any anonymous user can submit a registration request that specifies a privileged role value, resulting in immediate access to functionality reserved for administrators or instructors.

The flaw is classified as improper privilege management [CWE-266]. The application trusts client-controlled input to determine authorization state, violating the principle that role assignment must be enforced by server-side logic tied to an authenticated administrator. Attackers require no valid credentials, no prior access, and no interaction from another user to succeed.

Root Cause

The root cause is the absence of authorization checks and input validation on the role field within the registration endpoint. The application blindly maps the submitted role value to the newly created account instead of assigning a fixed default role such as student. There is no allowlist enforcement, no privilege boundary between self-service registration and administrative provisioning.

Attack Vector

An attacker sends a crafted HTTP POST request to the registration endpoint with the role parameter set to a privileged value such as admin. The server creates the account and grants the requested role. The attacker then authenticates with the new credentials and inherits administrative capabilities within the platform.

The vulnerability manifests in the registration handler as described in the public GitHub Vulnerability Report. No synthetic exploit code is reproduced here; refer to the referenced advisory for request details.

Detection Methods for CVE-2026-86275

Indicators of Compromise

Newly created user accounts with administrator or instructor roles that were not provisioned by legitimate staff.
HTTP POST requests to auth.php containing a role parameter with elevated values such as admin.
Login events from accounts created moments earlier through the public registration endpoint.
Audit log entries showing role assignment occurring during registration rather than through an administrative workflow.

Detection Strategies

Review web server access logs for POST requests to the registration handler and correlate against the role field values in request bodies.
Query the application database for accounts whose creation timestamp coincides with a self-service registration event but whose role is not student.
Alert on any privileged account created without a corresponding administrator session initiating the change.

Monitoring Recommendations

Enable verbose application logging on auth.php to capture the full parameter set of registration attempts.
Forward web and application logs to a centralized analytics platform for baseline analysis of registration volume and role distribution.
Monitor for spikes in failed or successful registrations originating from a small set of source IP addresses.

How to Mitigate CVE-2026-86275

Immediate Actions Required

Restrict network access to the application until a patched version or code fix is deployed.
Audit the user database and remove any unauthorized accounts holding administrator or instructor privileges.
Rotate credentials and session tokens for legitimate administrative accounts as a precaution.
Review recent administrative actions for unauthorized configuration or data changes.

Patch Information

No vendor-supplied patch is referenced in the NVD entry at the time of publication. Administrators should track updates through the SourceCodester project page and the VulDB entry for CVE-2026-86275 for remediation status.

Workarounds

Modify auth.php so the register function ignores any client-supplied role value and assigns a hardcoded default role such as student.
Move role assignment to an administrator-only endpoint protected by session-based authorization checks.
Implement an allowlist for permitted role values and reject requests containing any other value.
Place the application behind a web application firewall rule that strips or blocks the role parameter on requests to the registration endpoint.

bash

# Example WAF rule concept (ModSecurity-style)
SecRule REQUEST_URI "@endsWith /auth.php" \
  "chain,phase:2,deny,status:403,id:1026086275,\
   msg:'CVE-2026-86275 block role parameter in registration'"
  SecRule ARGS_NAMES "@streq role" "t:lowercase"