CVE-2026-75460 in XueZhiSi Open Source Exam System
Summary
by MITRE • 08/31/2026
XueZhiSi Open Source Exam System <= 3.9.0 has a privilege escalation vulnerability in the teacher-end interface POST /api/teacher/user/page/list. The role parameter in UserPageRequestVM is fully controllable by the requester.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 08/31/2026
The XueZhiSi Open Source Exam System, specifically versions up to and including 3.9.0, contains a critical privilege escalation vulnerability within its teacher-end interface. This flaw resides in the POST /api/teacher/user/page/list endpoint, which is designed for paginated retrieval of user lists by administrative or teaching staff. The core technical deficiency lies in how the backend processes the role parameter contained within the UserPageRequestVM data transfer object. Instead of enforcing server-side validation to ensure that the requesting entity possesses the necessary privileges to filter users by a specific role, the system blindly trusts and applies the value provided directly from the client request. This represents a classic case of insecure direct object references combined with broken access control mechanisms, where the application fails to verify if the authenticated user is authorized to perform actions or view data associated with higher-privilege roles than their own.
From a technical perspective, this vulnerability allows an attacker who has obtained valid credentials for a low-privileged account, such as a standard student or basic teacher role, to manipulate the HTTP request payload. By modifying the JSON body of the POST request and setting the role parameter to values corresponding to administrators or super-users, the backend processes the query without checking if the current session holder is permitted to execute such filters. Consequently, the system returns sensitive user data associated with those elevated roles. This behavior indicates a failure in implementing proper authorization checks at the business logic layer, where the assumption that the client will not tamper with input parameters leads to significant security gaps. The vulnerability aligns closely with CWE-269, which describes Improper Privilege Management, and specifically relates to CWE-862, Missing Authorization, as the application does not enforce policy decisions regarding who can access what resources based on their assigned role.
The operational impact of this flaw is severe, primarily due to the potential for unauthorized data exposure and further system compromise. An attacker exploiting this vulnerability can enumerate user accounts belonging to administrators or other high-privilege users within the exam system. This information disclosure provides valuable intelligence for subsequent attacks, such as targeted phishing campaigns against staff members or credential stuffing attempts if password hashes are exposed in related endpoints. Furthermore, gaining visibility into administrative accounts may facilitate lateral movement within the network infrastructure hosting the application. In some implementations of similar systems, this privilege escalation can serve as a stepping stone to more critical vulnerabilities, potentially allowing an attacker to inject malicious code or alter exam configurations if additional logic flaws exist downstream that rely on user identity rather than strict role-based access control checks.
To mitigate this vulnerability, immediate remediation efforts should focus on implementing robust server-side authorization controls. Developers must ensure that all API endpoints validate the permissions of the authenticated user before processing any input parameters that influence data retrieval or modification. Specifically for the /api/teacher/user/page/list endpoint, the backend logic should ignore role filters submitted by users who do not possess administrative privileges, effectively restricting such queries to only those roles explicitly allowed to perform them. Additionally, adopting a principle of least privilege across all system components and conducting regular security code reviews can help identify similar patterns in other endpoints. Organizations relying on this open-source solution should also monitor for official patches or updates from the XueZhiSi development team that address these access control deficiencies. Until patched, deploying Web Application Firewalls with rules to detect anomalous role parameter manipulation may offer a partial layer of defense, though strict server-side validation remains the only effective long-term solution. This incident underscores the importance of rigorous input validation and authorization checks in all web applications handling sensitive educational data.