The teacher‑end API endpoint /api/teacher/user/delete/{id} in the XueZhiSi Open Source Exam System accepts a user identifier and executes a delete operation without verifying that the authenticated teacher has authority to remove that user. An authenticated teacher (role=2) can therefore delete an administrator account (role=3). This represents a vertical privilege escalation that allows a lower‑privileged user to perform a high‑privileged operation and can lead to compromise of administrative controls, data loss, or further abuse of system capabilities.

XueZhiSi Open Source Exam System versions 3.9.0 and any earlier release are affected. The vulnerability is present in the teacher‑end interface of the open‑source code base and has been identified in repositories prior to the 3.9.0 release.

The EPSS score is < 1% and the vulnerability is not listed in the CISA KEV catalog, indicating no known widespread exploitation. However, the vulnerability is exploitable by any authenticated teacher user within the system, with no external attack vector. Because the flaw allows elevation of privileges from teacher to administrator, the potential impact on confidentiality, integrity, and availability is high. The CVSS score is 8.1, reflecting a high severity rating. Attackers would need to have valid teacher credentials and be able to invoke the delete endpoint, but once in place they can remove administrator accounts and potentially compromise the entire system.