CVE-2026-12529: SourceCodester CET Grading System Improper Access Control Vulnerability

Technical summary

CVE-2026-12529 involves improper access control mechanisms (CWE-266: Incorrect Privilege Assignment, CWE-284: Improper Access Control) in the student self-registration endpoint of SourceCodester CET Automated Grading System 1.0. The vulnerability is network-accessible, has low attack complexity, requires no authentication, and causes limited confidentiality, integrity, and availability impact. The attack vector is remote and unauthenticated, making it broadly exploitable by any network-connected actor without prerequisites.

Business impact

This vulnerability could allow unauthorized individuals to register accounts, access student records, modify grades, or access sensitive educational data without proper authentication. For educational institutions relying on this system, the risk includes data breaches affecting student privacy, grade manipulation leading to academic integrity violations, and potential reputational damage. Organizations using this grading platform should treat this as a priority security incident given the sensitivity of educational records and the potential for widespread unauthorized access.

Affected systems

SourceCodester CET Automated Grading System with AI Predictive Analytics version 1.0 is confirmed affected. The vulnerability is present in the /index.php file, specifically within the student self-registration endpoint. Organizations running this version are directly impacted. Verify your instance version against vendor documentation to confirm exposure.

Exploitability

The vulnerability is highly exploitable. It requires no authentication (PR:N), no user interaction (UI:N), and has low attack complexity (AC:L), meaning an attacker can trigger the flaw with basic HTTP requests to the student registration endpoint. The network-accessible nature (AV:N) means any internet-connected attacker can attempt exploitation. No specialized tools or advanced techniques are required, making this a practical threat in the near term.

Remediation

Immediate actions include isolating or disabling the affected CET Automated Grading System instance if a patch is unavailable, restricting network access to the application to trusted networks only, and reviewing access logs for signs of unauthorized registration or account creation. Contact SourceCodester for security updates addressing the improper access control flaw. Implement network-level controls such as IP whitelisting, Web Application Firewall (WAF) rules targeting the /index.php endpoint, and multi-factor authentication for sensitive functions. Conduct a comprehensive audit of student accounts created during the vulnerability window.

Patch guidance

Check SourceCodester's security advisories and vendor portal for patched versions of CET Automated Grading System that address CVE-2026-12529. Apply patches immediately upon availability to the student self-registration endpoint. Verify patch deployment by testing the registration function with unauthenticated requests to confirm access controls are enforced. Until patches are available, implement compensating controls such as disabling the student self-registration feature and using administrator-only account provisioning.

Detection guidance

Monitor access logs for /index.php requests originating from external networks, unusual patterns of student account creation, and registration attempts with invalid or suspicious data. Look for HTTP requests to the self-registration endpoint that bypass expected authentication flows. Implement alerting on rapid account creation rates, registration attempts with administrator email addresses, or accounts with elevated privileges created through the self-registration endpoint. Review authentication bypass attempts and unauthorized privilege escalation in application logs.

Why prioritize this

This vulnerability merits high priority due to its CVSS 3.1 score of 7.3 (HIGH severity), network-accessible attack surface, lack of authentication requirements, and direct impact on core educational data integrity. The broad exploitability combined with access to sensitive student information makes this a business-critical risk. Educational institutions should treat this as requiring emergency response-level attention.

Risk score, explained

The CVSS 3.1 score of 7.3 reflects a network-accessible vulnerability (AV:N) with low attack complexity (AC:L) that requires no authentication (PR:N) or user interaction (UI:N). The impact is bounded to low levels of confidentiality, integrity, and availability loss (C:L, I:L, A:L) rather than complete compromise, resulting in a HIGH but not CRITICAL rating. The lack of scope change (S:U) limits the blast radius, but the ease of exploitation and authentication bypass characteristics elevate the severity significantly above average.

Frequently asked questions