CVE-2026-75458

XueZhiSi Open Source Exam System versions up to and including 3.9.0 expose a teacher-end interface, POST /api/teacher/user/delete/{id}, that performs getUserById(id), setDeleted(true) and updateByIdFilter() without verifying that the calling user is authorized to delete the target account. Any authenticated user holding the teacher role (role=2) can call this endpoint with the numeric ID of an administrator account (role=3), soft-deleting that administrator. The result is a vertical privilege escalation in which a lower-privileged teacher can remove higher-privileged accounts, potentially disrupting administrator access to the system (CVSS 3.1 rates this High, 8.1, with integrity and availability impact and no confidentiality impact). All deployments of the exam system at version 3.9.0 or earlier are affected; exploitation requires an authenticated teacher account, so internet-exposed instances with self-registered or weakly controlled teacher accounts face the greatest risk. No public proof-of-concept, CISA KEV listing, or reports of in-the-wild exploitation are known, and EPSS currently estimates only a 0.3% chance of exploitation within 30 days.

What to do: Upgrade to a release newer than 3.9.0 when a patched version becomes available, and as an interim mitigation restrict access to /api/teacher/user/delete/{id} at a reverse proxy or WAF so teacher-role accounts cannot target administrator user IDs. Audit application logs for POST requests to this endpoint and review the user table for unexpectedly soft-deleted administrator (role=3) accounts, which would indicate prior abuse.