CVE-2026-14778: Authorization Bypass in SourceCodester LMS Enrollment

Technical summary

CVE-2026-14778 is an improper authorization vulnerability (CWE-266, CWE-285) in the enrollment management component of SourceCodester Online Examination & Learning Management System 1.0. The flaw resides in /ajax_enroll.php, where insufficient access controls allow manipulation of student_id, schedule_id, and action parameters. The lack of proper authentication and authorization checks enables remote exploitation with a network vector, low attack complexity, and no privileges or user interaction required. The CVSS v3.1 score of 7.3 (HIGH) reflects low impact to confidentiality, integrity, and availability across all scope boundaries.

Business impact

Educational institutions and online learning platforms using this LMS face direct risk of unauthorized enrollment modifications, student record tampering, and potential schedule manipulation. Attackers could enroll unauthorized users, modify course assignments, or access sensitive student information without proper credentials. This compromises the integrity of academic records, potentially invalidates course completion certifications, and exposes student personally identifiable information. The public disclosure of exploitation details accelerates the timeline to real-world attack deployment.

Affected systems

SourceCodester Online Examination & Learning Management System version 1.0 is affected. Organizations should inventory all instances of this application, particularly those exposed to untrusted networks. The product name contains a documented typo in vendor materials, which may complicate identification during asset discovery.

Exploitability

The vulnerability is highly exploitable in practical attack scenarios. No authentication is required, attack complexity is low, and exploitation can occur remotely over the network. The public disclosure of the vulnerability and potential proof-of-concept code significantly reduces the barrier to entry for threat actors. Active exploitation should be anticipated, particularly if the application is internet-facing or accessible from less-trusted network segments.

Remediation

Immediate action is required: verify whether your organization runs SourceCodester Online Examination & Learning Management System 1.0 or any related versions. Contact SourceCodester for patched versions addressing the authorization bypass. As an interim measure, implement network segmentation to restrict access to the LMS to trusted networks only, and apply strict access controls at the application layer. Consider reviewing access logs for /ajax_enroll.php to identify potential exploitation attempts.

Patch guidance

Verify the availability of patched versions from SourceCodester through their official security advisories or support channels. Apply patches during a scheduled maintenance window, with careful testing in a non-production environment first. Prioritize patching for internet-facing or externally accessible instances. If patches are unavailable or delays are anticipated, implement compensating controls such as WAF rules to block suspicious parameter manipulation on the /ajax_enroll.php endpoint.

Detection guidance

Monitor HTTP requests to /ajax_enroll.php for anomalous patterns, including requests with unusual student_id or schedule_id parameter values, requests from unexpected source IPs, or rapidly sequential requests suggesting automated exploitation. Implement alerting on failed authorization attempts or access to enrollment functions by unauthenticated users. Review application logs for error conditions related to authorization failures in the enrollment module. Analyze network traffic for signs of reconnaissance or scanning targeting the vulnerable endpoint.

Why prioritize this

This vulnerability should be addressed with high priority due to the combination of network-accessible attack surface, zero authentication requirement, public disclosure status, and direct impact on data integrity and confidentiality. The educational context amplifies risk because student records and enrollment data carry compliance implications (FERPA in the US, GDPR if EU-based). Threat actors are likely developing or refining exploits given the public disclosure timeline.

Risk score, explained

The CVSS 7.3 HIGH score reflects the vulnerability's exploitability (network vector, low complexity, no privileges required) balanced against moderate impact scope. Confidentiality, integrity, and availability are each rated as Low rather than High because attackers can access or modify individual enrollment records and student data without system-wide compromise. The lack of user interaction required and absence of complex preconditions elevate the practical risk above the numeric score alone suggests.

Frequently asked questions