CVE-2026-97879
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk49th percentile - higher than 49% of all known CVEs
Summary
A security flaw has been discovered in zhistaredu StarTraining up to 3.8.1. The affected element is an unknown function of the file SecurityConfig.java of the component api-docs Endpoint. Performing a manipulation results in missing authentication. It is possible to initiate the attack remotely. The exploit has been released to the public and may be used for attacks.
Risk Assessment
Missing authentication may allow unauthorized access to sensitive API functions, potentially leading to data breach or system compromise.
Recommendation
Check for vendor updates immediately; if none, restrict access to the api-docs Endpoint and monitor logs for unauthorized requests.
Other vulnerabilities in StarTraining
See all- CVE-2026-100881Low
A security vulnerability has been detected in zhistaredu StarTraining up to 3.8.1. This issue affects some unknown processing of the file application.yml. Such manipulation of the argument xss.enabled leads to cross site scripting. It is possible to launch the attack remotely. Attacks of this nature are highly complex. The exploitability is assessed as difficult. The exploit has been disclosed publicly and may be used. Not independently exploitable: a defense-in-depth absence that amplifies CVE-2026-100880. The vendor was contacted early about this disclosure but did not respond in any way.
- CVE-2026-100879Medium
A security flaw was discovered in zhistaredu StarTraining up to 3.8.1 affecting the checkRoleAllowed function in SysRoleServiceImpl.java of the dataScope Endpoint component. The manipulation results in missing authorization and can be performed remotely.
- CVE-2026-100878Medium
A vulnerability was identified in zhistaredu StarTraining up to 3.8.1 affecting the SysUser.isAdmin function in edu-common/src/main/java/com/edu/common/core/domain/entity/SysUser.java of the authRole Endpoint component. Manipulation of the userId/roleIds arguments leads to authorization bypass and can be carried out remotely.
Original NVD description (English source)
A security flaw has been discovered in zhistaredu StarTraining up to 3.8.1. The affected element is an unknown function of the file SecurityConfig.java of the component api-docs Endpoint. Performing a manipulation results in missing authentication. It is possible to initiate the attack remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS