A vulnerability in the Kushan2k student-management-system allows manipulation of the "isadmin" argument in the edit-admin function of AdminController.php. By altering this parameter, an attacker can bypass the intended authorization controls and gain administrator privileges within the application. The defect is a direct result of improper authorization checks and is listed in CWE-266 and CWE-285.

The flaw affects the Kushan2k student-management-system application. No specific release numbers are provided, as the project follows a rolling‑release model and does not disclose affected commit hashes publicly. Administrators should consider that any deployment of the application preceding the fix could be vulnerable.

The CVSS score is 5.3, indicating a moderate severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Attackers can possibly exploit the flaw remotely by sending a crafted HTTP request to the edit‑admin endpoint with the "isadmin" parameter altered, thereby escalating privileges. Because the vulnerability is caused by an inadequate auth check rather than a denial‑of‑service flaw, the impact would primarily be confidentiality and integrity loss for the system and its data.