A flaw in PolarLearn’s account‑management module reverses the administrative check for the setCustomPassword and deleteUser functions, allowing any authenticated, non‑admin user to invoke these actions while real administrators are denied. This inversion grants ordinary users the ability to reset passwords for any account and delete users, effectively elevating their privileges to system administrators. The weakness is identified as CWE‑285: Improper Authorization.

PolarLearn, the free and open‑source learning platform from polarnl, is affected in all releases up to and including 0‑PRERELEASE‑14. Versions released after 0‑PRERELEASE‑14 contain a corrected check and are no longer vulnerable.

The CVSS score of 8.8 indicates a high severity issue. Although no EPSS score is available and the vulnerability is not listed in the CISA KEV catalog, the attack scenario is straightforward: an authenticated non‑admin user simply sends requests to the vulnerable endpoints while maintaining an active session. As a result, any user with valid credentials can acquire full administrative control, compromising all data and system integrity.