The vulnerability resides in the teacher‑end interface of the XueZhiSi Open Source Exam System. A fully controllable role parameter in the UserPageRequestVM allows an authenticated user to specify any role, thereby elevating privileges beyond those intended for the request. This can result in unauthorized access to teacher functionalities, data leakage, or tampering with exam content, compromising confidentiality, integrity, and availability of the exam system. The weakness is a classic privilege escalation flaw classified as CWE‑639.

XueZhiSi Open Source Exam System, versions up to and including 3.9.0. The flaw exists in the teacher API endpoint POST /api/teacher/user/page/list and pertains to user role handling. No specific vendor product names beyond XueZhiSi are identified.

Based on the description, the POST /api/teacher/user/page/list endpoint is likely reachable over HTTP/S and accepts JSON payloads, allowing an authenticated user to supply a role field. The absence of validation or whitelist checks lets attackers bind arbitrary roles, effectively achieving privilege escalation. The EPSS score is less than 1% and the CVSS score is 6.5; the vulnerability is not listed in the CISA KEV catalog, but the lack of role restrictions indicates a high likelihood of exploitation if attackers reach the API.