Description

A vulnerability was identified in zhistaredu StarTraining up to 3.8.1. Affected by this issue is the function SysUser.isAdmin of the file edu-common/src/main/java/com/edu/common/core/domain/entity/SysUser.java of the component authRole Endpoint. The manipulation of the argument userId/roleIds leads to authorization bypass. The attack is possible to be carried out remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.3",
  "pubDate": "2026-09-27T21:17:01.100Z",
  "pubdate": "2026-09-27T21:17:01.100Z",
  "executiveSummary": "A critical authorization bypass vulnerability exists in the authRole endpoint of zhistaredu StarTraining versions up to 3.8.1.\nThe vulnerability resides within the SysUser.isAdmin function, which fails to properly validate user-supplied input.\nBy manipulating specific parameters such as userId or roleIds, a remote, unauthenticated attacker can circumvent access control mechanisms.\nThe successful exploitation of this flaw allows unauthorized actors to escalate privileges or gain administrative access to the system.\nThis vulnerability poses a severe risk to data integrity and system confidentiality.\nGiven that public exploit code is available and the vendor has remained unresponsive to disclosure, organizations are at a high risk of active exploitation.\nImmediate action is required to implement compensatory controls to prevent unauthorized access to sensitive endpoints.",
  "technicalDetails": "The vulnerability is located in the file edu-common/src/main/java/com/edu/common/core/domain/entity/SysUser.java within the SysUser.isAdmin function.\nThe root cause of the issue is an insecure implementation of access control logic within the authRole endpoint, which relies on user-controllable input for authorization decisions without secondary server-side verification.\nSpecifically, the application fails to perform an authoritative check on the security context of the requester, instead trusting the provided userId or roleIds parameters when determining administrative privileges.\nAn attacker can exploit this by crafting malicious HTTP requests to the authRole endpoint, modifying the userId or roleIds parameters to match those of an administrative account.\nBecause the SysUser.isAdmin function evaluates the manipulated input as the primary source of truth for authorization status, the application incorrectly grants administrative rights to the requesting session.\nThe attack flow follows a predictable pattern: first, the attacker identifies the target authRole endpoint; second, the attacker probes the input parameters, specifically focusing on userId and roleIds; third, the attacker transmits a request injected with unauthorized values; finally, the system executes the flawed isAdmin logic, validates the attacker as an administrator, and grants access to protected functions or data.\nThis vulnerability is remotely exploitable, meaning no local access or prior authentication is required to initiate the attack chain.\nThe post-exploitation impact includes full administrative compromise of the user management module, potentially allowing for account takeover, unauthorized modification of user records, and access to privileged administrative functions within the StarTraining ecosystem.\nSince the function lacks strict input sanitization or server-side session binding for the authorization check, it remains highly susceptible to simple parameter tampering techniques.\nThe availability of public exploit material increases the likelihood of automated or manual scanning by malicious actors attempting to identify vulnerable instances."
}