CVE-2026-75458

17th percentile - higher than 17% of all known CVEs

The teacher-end interface POST /api/teacher/user/delete/{id} in XueZhiSi Open Source Exam System <= 3.9.0 contains a vertical privilege escalation vulnerability. This interface accepts a user ID and then executes getUserById(id), setDeleted(true), updateByIdFilter() in sequence, without any validation of whether the current user has the authority to delete the target user. An authenticated teacher user (role=2) can delete an administrator account (role=3), constituting a vertical privilege escalation where a lower-privileged user performs a high-privileged operation.

A teacher can delete administrator accounts, potentially leading to loss of system control, service disruption, or full system compromise.

Update the system to a patched version or add permission validation before performing delete operations.