CVE-2026-14719: Privilege Escalation in SourceCodester Learning Management System 1.0

Technical summary

CVE-2026-14719 is a privilege escalation vulnerability in the registration.php component of SourceCodester Online Examination & Learning Management System 1.0. The vulnerability stems from improper validation of the role parameter in the registration endpoint, allowing attackers to manipulate privilege assignments during account creation. The flaw maps to CWE-266 (Improper Privilege Management) and CWE-269 (Improper Access Control), indicating a failure to enforce authorization controls on user role assignment. The attack vector is network-based, requires no authentication or user interaction, and impacts the integrity, confidentiality, and availability of the affected application.

Business impact

This vulnerability poses a significant operational and security risk to organizations deploying this learning management system. Attackers can create administrative or privileged accounts without restriction, granting them full access to exam content, student records, and system configuration. Potential business impacts include unauthorized access to sensitive educational data, system compromise, integrity violations of assessment scores and credentials, and reputational damage. For institutions managing student data, this creates FERPA and GDPR compliance violations. The availability of public exploit code accelerates the likelihood of mass exploitation.

Affected systems

SourceCodester Online Examination & Learning Management System version 1.0 is confirmed as vulnerable. Organizations running this specific version, particularly in educational institutions, testing centers, or corporate training environments, are at direct risk. The product name appears to contain a typo in the vendor's original documentation, so careful verification of installed versions is recommended during asset inventory reviews.

Exploitability

This vulnerability is readily exploitable with low technical barriers. No authentication is required, and the attack requires only a simple HTTP request to the registration endpoint with a manipulated role parameter. The flaw requires no user interaction and works over the network, making it accessible from the internet if the system is exposed. The publication of exploit code further reduces the barrier to exploitation, enabling both sophisticated threat actors and opportunistic attackers to abuse this weakness immediately.

Remediation

Immediate action is required. Organizations should prioritize patching to the latest available version of SourceCodester Online Examination & Learning Management System. Verify patch availability directly from the vendor's official advisory or download portal. As an interim measure, restrict network access to the application to authorized users only through firewall rules or VPN gateways, implement Web Application Firewall rules to block suspicious role manipulation attempts in registration requests, and monitor registration activity for anomalies indicative of privilege escalation attempts. Consider disabling the registration endpoint temporarily if a patch is unavailable and user onboarding can be managed through alternative channels.

Patch guidance

Contact SourceCodester directly or review their official security advisories for available patches beyond version 1.0. Test patches in a non-production environment before deployment to ensure compatibility with existing data and configurations. Verify that patched versions include input validation and server-side role assignment controls that prevent client-side manipulation. Document the patching date and version applied for compliance records.

Detection guidance

Monitor registration endpoint logs for requests containing unusual or privileged role values (such as admin, administrator, superuser, or other elevated roles) in registration parameters. Detect registration attempts originating from unexpected geographic locations or with rapid-fire account creation patterns. Flag newly created accounts that immediately perform administrative actions such as accessing exam content, modifying settings, or bulk downloading student records. Inspect HTTP POST requests to register.php for evidence of parameter tampering, such as role=admin in request bodies that should not contain this field. Correlate account creation timestamps with subsequent unauthorized actions in system audit logs.

Why prioritize this

This vulnerability merits high priority due to the combination of a HIGH CVSS score (7.3), zero authentication barriers, network accessibility, public exploit availability, and immediate privilege escalation impact. The flaw undermines the entire access control model of a learning management system, making it critical to address before further exploitation occurs. Educational institutions managing confidential student data face particular urgency due to regulatory exposure.

Risk score, explained

The CVSS 3.1 score of 7.3 reflects the severity of unauthenticated remote privilege escalation. The network attack vector (AV:N), low attack complexity (AC:L), and lack of privilege requirements (PR:N) or user interaction (UI:N) indicate an easily exploitable flaw. The moderate scope (S:U) and impact on confidentiality, integrity, and availability (C:L/I:L/A:L) correctly capture the threat of account compromise and unauthorized system access. The absence of KEV listing does not diminish urgency; prompt patching is essential before active exploitation campaigns begin.

Frequently asked questions