The flaw in CollegeManagementSystem allows an attacker to manipulate the UserAuthData argument in the admin_page.php file, bypassing authorization checks and gaining unauthorized access to the admin interface. This bypass is rooted in improper handling of authentication tokens, as classified by CWE‑266 and CWE‑285, potentially giving an attacker full administrative control. The condition is triggered via externally supplied input and can be activated remotely.

All current and future releases from the tittuvarghese/CollegeManagementSystem GitHub repository are potentially vulnerable, since the project follows a rolling release model and no specific affected versions are identified. The vulnerability resides in an unknown function of the dashboard_page/admin_page.php component of the Admin Interface.

The CVSS score of 5.3 indicates a moderate severity, and the EPSS score is not available, so a precise exploitation probability cannot be stated. The vulnerability is not listed in CISA KEV and the exploit requires remote interaction, suggesting that an attacker could craft malicious requests to the admin_page.php endpoint to gain elevated privileges. While the exploit is currently feasible, the risk level remains moderate pending a patch from the vendor.