CVE-2026-90787: Soarkey StudentManagement Privilege Escalation

CVE-2026-90787 Overview

CVE-2026-90787 is an improper privilege management vulnerability [CWE-266] in the Soarkey StudentManagement application. The flaw resides in the RegisterServlet.doPost function within code/WebContent/register.html, part of the Registration Workflow component. Attackers can manipulate the level argument during registration to assign themselves elevated privileges. The attack is remotely exploitable without authentication or user interaction. A public proof-of-concept exists, and the project maintainer has not responded to the initial issue report. Because the project does not use versioning, affected and unaffected releases cannot be enumerated beyond commit e08f7f1d5015af407aa4cca0ada3dea189b4937e.

Critical Impact
Remote unauthenticated attackers can register accounts with arbitrary privilege levels, gaining administrative access to the StudentManagement application.

Affected Products

Soarkey StudentManagement (up to commit e08f7f1d5015af407aa4cca0ada3dea189b4937e)
Registration Workflow component (RegisterServlet.doPost)
code/WebContent/register.html endpoint

Discovery Timeline

2026-09-14 - CVE-2026-90787 published to NVD
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-90787

Vulnerability Analysis

The vulnerability exists in the registration workflow handled by RegisterServlet.doPost. The servlet reads a client-supplied level parameter from the registration form and persists it directly to the user record without server-side authorization checks. This allows any unauthenticated user submitting the registration form to select the account privilege tier assigned to the new account.

Because the application is a Java servlet-based student management system, the level field typically distinguishes between students, teachers, and administrators. Trusting a client-controlled value for this field converts a self-service registration endpoint into a privilege escalation primitive.

The issue is classified under [CWE-266: Incorrect Privilege Assignment]. The project uses rolling commits without version tags, so remediation cannot be pinned to a released build.

Root Cause

The root cause is the absence of server-side enforcement of role assignment during account creation. The RegisterServlet accepts the level request parameter as authoritative rather than deriving the role from server logic or restricting it to a fixed default. No allow-list, no session-based authorization, and no admin-approval workflow gates the elevated role.

Attack Vector

An attacker sends an HTTP POST request to the registration endpoint with a modified level parameter set to an administrative value. No prior authentication, tokens, or user interaction are required. Once the account is created with elevated privileges, the attacker logs in and gains access to administrative functionality exposed by the application.

No verified exploit code is reproduced here. Refer to the GitHub Issue #35 Discussion and VulDB CVE-2026-90787 entries for technical references.

Detection Methods for CVE-2026-90787

Indicators of Compromise

POST requests to /RegisterServlet or register.html containing a level parameter with values corresponding to elevated roles (for example, administrator identifiers).
Newly created accounts with administrative privileges that did not follow an approval workflow or originate from an existing admin session.
Sudden appearance of unfamiliar high-privilege usernames in the user database.

Detection Strategies

Inspect web server access logs for registration POST requests that include a level parameter, and flag any value that is not the default student role.
Compare application user tables against expected administrator lists on a scheduled basis and alert on discrepancies.
Deploy web application firewall (WAF) rules that block or strip the level parameter on the registration endpoint.

Monitoring Recommendations

Monitor authentication logs for first-time logins from newly registered accounts that immediately access administrative endpoints.
Alert on privilege changes and account creation events with correlation to the originating source IP address.
Ingest application and web server logs into a centralized analytics platform for retrospective hunting across registration activity.

How to Mitigate CVE-2026-90787

Immediate Actions Required

Disable or restrict public access to the register.html endpoint until a fix is deployed.
Audit the user database for accounts with elevated level values and remove or downgrade unauthorized entries.
Rotate credentials and invalidate active sessions for any suspicious administrator accounts.

Patch Information

No official patch is available. The maintainer has not responded to the upstream issue report referenced in GitHub Issue #35 Discussion. Organizations running this codebase must fork and patch the servlet locally by hardcoding the default role in RegisterServlet.doPost and rejecting any client-supplied level parameter.

Workarounds

Modify RegisterServlet.doPost to ignore the level request parameter and always assign the lowest-privilege role at registration.
Front the application with a reverse proxy or WAF that strips or normalizes the level field on requests to the registration endpoint.
Require administrative review and manual promotion for any privileged role assignment, moving role management out of the self-service registration flow.

bash

# Example nginx configuration to strip the level parameter on registration requests
location = /RegisterServlet {
    if ($request_method = POST) {
        # Remove client-supplied level parameter before proxying
        set $args "";
    }
    proxy_pass http://studentmanagement_backend;
}