CVE-2026-11533

Vulnerability

An improper authorization vulnerability exists in the student deletion endpoint, specifically in the /see.php file of the imvks786 student_management_system up to commit 9599b560ad3c3b83e75d328b76bedcd489ef1f46. The del parameter is used to delete student records, but the DELETE query is executed before any authorization checks are performed [2]. This product uses a rolling release, so specific affected and updated versions are not available [1].

Exploitation

An attacker can exploit this vulnerability remotely by crafting a GET request to /see.php. The attacker needs to be logged in with a user account that has only VIEW permission, such as the default admin1 account. By including ?submit=submit&del=<student_id> in the request, the attacker can initiate the deletion of any student record, as the server-side authorization check occurs after the deletion query has already been executed [2].

Impact

Successful exploitation allows an attacker with VIEW privileges to delete any student record from the system. This leads to unauthorized data destruction and loss of integrity for student records. The scope of the compromise is limited to the data within the student management system that the attacker can identify and target for deletion [2].

Mitigation

No specific patched version or release date is available as the project has not responded to the issue report. Users are advised to implement custom access controls or monitor the GitHub repository for future updates. The project was informed early, but no fix has been released yet [1, 2].