A function in the authRole endpoint, SysUser.isAdmin, checks a user’s administrative status but relies on user-supplied parameters. By manipulating the userId and roleIds arguments, an attacker can bypass this check and assume administrator privileges. The flaw results in a full authorization bypass, allowing unauthorized users to perform actions reserved for administrators, a classic example of CWE-285 and CWE-639 weaknesses.

The vulnerability affects the StarTraining application from zhistaredu, versions up to and including 3.8.1. Any deployment running these or earlier versions is susceptible to the described authorization bypass.

The CVSS score of 5.3 indicates moderate severity. The publicly available exploit and remote attack feasibility raise the practical risk, despite the absence of an EPSS score or KEV listing. Administrators should consider the possibility of successful privilege escalation in deployments that expose the authRole endpoint.