What’s Vulnerable › Vulnerabilities

CVE-2026-75458

• Severity: high (CVSS 8.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-08-31 · updated 2026-09-01
• Weakness: CWE-639

Description

The teacher-end interface POST /api/teacher/user/delete/{id} in XueZhiSi Open Source Exam System <= 3.9.0 contains a vertical privilege escalatio vulnerability. This interface accepts a user ID and then executes getUserById(id), setDeleted(true), updateByIdFilter() in sequence, without any validation of whether the current user has the authority to delete the target user. An authenticated teacher user (role=2) can delete an administrator account (role=3), constituting a vertical privilege escalation where a lower-privileged user performs a high-privileged operation.

References

• https://github.com/mindskip/xzs/compare/master...1258129581:xzs:patch-2
• https://github.com/mindskip/xzs/compare/master...1258129581:xzs:patch-2

Get alerted when CVE-2026-75458 or the next vulnerability affects your stack