CVE-2026-9517: CodeIgniter Student System Auth Bypass

CVE-2026-9517 Overview

CVE-2026-9517 is an improper access control vulnerability [CWE-266] in the hemant6488 CodeIgniter-StudentManagementSystem project. The flaw resides in an unspecified function within /index.php/students/addStudentView, part of the Student Management Handler component. Attackers can exploit the weakness remotely without authentication or user interaction. The exploit details have been publicly disclosed, increasing the likelihood of opportunistic abuse. Because the project follows a rolling release model, no discrete version identifiers are available for affected or fixed builds. The maintainer was notified through a GitHub issue but has not responded.

Critical Impact
Unauthenticated remote attackers can bypass access controls on the student management interface, affecting confidentiality, integrity, and availability of application data.

Affected Products

hemant6488 CodeIgniter-StudentManagementSystem (rolling release)
Component: Student Management Handler
Endpoint: /index.php/students/addStudentView

Discovery Timeline

2026-05-26 - CVE-2026-9517 published to NVD
2026-05-26 - Last updated in NVD database

Technical Details for CVE-2026-9517

Vulnerability Analysis

The vulnerability stems from missing or inadequate access control checks on the addStudentView endpoint exposed through the CodeIgniter front controller at /index.php/students/addStudentView. The handler does not enforce role validation or session-based authorization before executing privileged operations tied to student record management. Because the application is reachable over the network and requires neither credentials nor user interaction, the endpoint can be invoked directly by any remote client. Public disclosure of the exploit lowers the technical barrier for attackers and raises the risk of automated scanning against exposed instances.

Root Cause

The root cause is classified under [CWE-266] Incorrect Privilege Assignment. The application grants access to a sensitive function without verifying that the requesting principal holds the required privileges. The students controller exposes administrative-style views without enforcing an authorization gate, allowing unauthenticated requests to reach functionality intended for privileged users. The rolling-release distribution model compounds the issue because no labeled fixed version exists for defenders to pin against.

Attack Vector

An attacker sends a crafted HTTP request to /index.php/students/addStudentView on a reachable instance of the application. No credentials, tokens, or social engineering steps are required. Successful exploitation grants the attacker access to student management functionality that should be restricted, enabling viewing or manipulation of student records. The vulnerability is described in the public VulDB entry and the corresponding GitHub issue.

No verified proof-of-concept code is published in the available references. See the GitHub project repository for source-level context on the affected controller.

Detection Methods for CVE-2026-9517

Indicators of Compromise

Unauthenticated HTTP requests to /index.php/students/addStudentView from external IP addresses.
Web server access logs showing requests to students/* routes lacking a valid session cookie or authentication header.
Unexpected creation, modification, or enumeration of student records in the application database.

Detection Strategies

Deploy web application firewall (WAF) rules that require authenticated session context for requests to /index.php/students/ paths.
Correlate application logs with identity logs to flag access to student management endpoints from sessions without an administrative role.
Hunt for anomalous bursts of requests to addStudentView originating from a single source IP or user-agent.

Monitoring Recommendations

Enable verbose access logging on the CodeIgniter application and forward logs to a centralized analytics platform.
Alert on HTTP 200 responses to students/addStudentView where the request lacks a session cookie associated with an authenticated administrator.
Track baseline traffic volume to student management routes and trigger alerts on statistically significant deviations.

How to Mitigate CVE-2026-9517

Immediate Actions Required

Restrict network exposure of the application to trusted networks or place it behind a VPN until a fix is available.
Add a reverse proxy or WAF rule that requires authenticated session cookies before forwarding requests to /index.php/students/*.
Audit application logs for prior unauthenticated access to addStudentView and review affected student records for tampering.

Patch Information

No vendor patch is currently available. The maintainer was notified through a GitHub issue but has not responded. Because the project uses a rolling release model, defenders must monitor the project repository for commits that introduce authorization checks on the students controller.

Workarounds

Implement an application-level authorization filter in the students controller that validates the user role before rendering addStudentView.
Block direct external access to /index.php/students/addStudentView at the web server or load balancer tier.
Require multi-factor authentication on the administrative interface to reduce the impact of any remaining authorization gaps.

bash

# Example nginx configuration restricting access to the vulnerable endpoint
location ~* ^/index\.php/students/ {
    # Allow only trusted internal networks
    allow 10.0.0.0/8;
    deny all;

    # Require an authenticated session cookie at the proxy tier
    if ($cookie_session_id = "") {
        return 401;
    }

    proxy_pass http://app_backend;
}