CVE-2026-86277: SourceCodester LMS Auth Bypass Flaw

CVE-2026-86277 Overview

CVE-2026-86277 is an authorization bypass vulnerability in SourceCodester Syllabus-Aligned Learning Management & Examination System 1.0. The flaw resides in the delete_exam.php script, where manipulation of the ID parameter allows an attacker to delete exam records belonging to other users. The issue is classified under [CWE-285: Improper Authorization] and represents an Insecure Direct Object Reference (IDOR) pattern. Remote exploitation is possible over the network without authentication, and public disclosure of the exploit technique has already occurred.

Critical Impact
Remote attackers can delete arbitrary exam records by tampering with the ID parameter in delete_exam.php, undermining the integrity and availability of examination data.

Affected Products

SourceCodester Syllabus-Aligned Learning Management & Examination System 1.0
Component: delete_exam.php
Deployment scope: web-facing PHP installations of the affected application

Discovery Timeline

2026-09-07 - CVE-2026-86277 published to NVD
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-86277

Vulnerability Analysis

The vulnerability is a classic Insecure Direct Object Reference in the exam deletion workflow. The delete_exam.php endpoint accepts an ID parameter that identifies the target exam record, then performs the deletion without verifying that the requesting user owns or has permission to remove that record. An attacker can iterate over ID values to delete arbitrary exams belonging to other instructors or students. The impact spans confidentiality, integrity, and availability at a low level, but the integrity loss on examination data can carry significant academic and operational consequences.

Root Cause

The root cause is missing authorization enforcement on a state-changing endpoint. The application trusts a client-supplied object identifier without validating that the authenticated session (or lack thereof) has the required permission on the referenced object. This pattern maps directly to [CWE-285] and is reinforced by the absence of server-side ownership checks before invoking the SQL DELETE statement.

Attack Vector

An attacker sends a crafted HTTP request to delete_exam.php with an ID value corresponding to a target exam. Because the endpoint does not enforce authorization, the record is deleted. The attack requires no privileges, no user interaction, and can be executed remotely across the network. The published proof-of-concept referenced in the GitHub Vulnerability Report demonstrates the parameter tampering technique. See the VulDB entry for CVE-2026-86277 for additional context.

No verified exploit code is reproduced here. Refer to the linked advisory for the technical proof-of-concept.

Detection Methods for CVE-2026-86277

Indicators of Compromise

Unexpected HTTP GET or POST requests to delete_exam.php with varying ID values from the same client.
Sudden or unexplained removal of exam records in the application database.
Web server access logs showing enumeration patterns against delete_exam.php.
Requests to delete_exam.php originating from unauthenticated sessions or unexpected source addresses.

Detection Strategies

Deploy web application firewall (WAF) rules that flag sequential ID values against deletion endpoints.
Correlate application audit logs to identify deletion actions performed by users who do not own the target resource.
Alert on any request to delete_exam.php outside of authenticated administrator workflows.

Monitoring Recommendations

Monitor PHP application logs for unusual volumes of exam-deletion requests over short intervals.
Enable database-level auditing on DELETE operations against the exam table.
Track HTTP referrers and session identifiers for delete_exam.php to identify direct-URL abuse.

How to Mitigate CVE-2026-86277

Immediate Actions Required

Restrict network access to the Syllabus-Aligned Learning Management & Examination System until a patch is available.
Add server-side ownership validation to delete_exam.php before executing the deletion query.
Require authenticated sessions with role-based checks for all state-changing endpoints.
Back up the exam database and enable point-in-time recovery to counter integrity loss.

Patch Information

No official vendor patch has been published at the time of NVD entry. Administrators should track the SourceCodester project page and the VulDB vulnerability record for remediation updates. Until an official fix is released, apply application-layer authorization checks or take the application offline in production environments handling sensitive academic data.

Workarounds

Place the application behind an authenticated reverse proxy that enforces access control on delete_exam.php.
Implement a WAF rule blocking direct requests to delete_exam.php from non-administrator roles.
Modify the source of delete_exam.php to validate session ownership of the referenced ID before deletion.
Replace predictable numeric ID values with unguessable identifiers (e.g., UUIDs) as a defense-in-depth measure.

bash

# Example nginx rule restricting delete_exam.php to internal admin network
location = /delete_exam.php {
    allow 10.0.0.0/24;   # admin subnet
    deny  all;
    include fastcgi_params;
    fastcgi_pass unix:/var/run/php/php-fpm.sock;
}