The vulnerability exists in the Student Self‑Registration endpoint of the SourceCodester CET Automated Grading System with AI Predictive Analytics. Manipulating an unknown function in /index.php removes or weakens the enforcement of access permissions, allowing an attacker to perform actions that should be restricted to authorized users. Remote exploitation is possible, giving an attacker the ability to gain unauthorized access to student or administrative functions and potentially alter grading data or create accounts.

The affected product is the SourceCodester CET Automated Grading System with AI Predictive Analytics, version 1.0. No other versions or vendor/minor product variations are documented as impacted.

The CVSS score of 6.9 indicates moderate overall severity, while the EPSS score of less than 1% suggests limited current exploitation activity. The vulnerability is not listed in CISA’s KEV catalog. Exploitation is likely to occur via a remote HTTP request to /index.php with crafted parameters, exploiting the improper access control to elevate privileges or bypass authentication. The lack of a public exploit or widespread reports reduces immediate risk, but the flaw permits unauthorized access to sensitive grading information.