https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 02 Nov 2026 17:32:55 +0000 https://db.gcve.eu/vuln/cve-2026-75458 <p>The teacher-end interface POST /api/teacher/user/delete/{id} in XueZhiSi Open Source Exam System &lt;= 3.9.0 contains a vertical privilege escalatio vulnerability. This interface accepts a user ID and then executes getUserById(id), setDeleted(true), updateByIdFilter() in sequence, without any validation of whether the current user has the authority to delete the target user. An authenticated teacher user (role=2) can delete an administrator account (role=3), constituting a vertical privilege escalation where a lower-privileged user performs a high-privileged operation.</p> <p>The teacher-end interface POST /api/teacher/user/delete/{id} in XueZhiSi Open Source Exam System &lt;= 3.9.0 contains a vertical privilege escalatio vulnerability. This interface accepts a user ID and then executes getUserById(id), setDeleted(true), updateByIdFilter() in sequence, without any validation of whether the current user has the authority to delete the target user. An authenticated teacher user (role=2) can delete an administrator account (role=3), constituting a vertical privilege escalation where a lower-privileged user performs a high-privileged operation.</p> https://db.gcve.eu/vuln/cve-2026-75458