A weakness exists in the Administrative Servlet component of Soarkey StudentManagement where the AdminDao.doGet method processes the 'action' request parameter without proper authorization checks. This flaw permits an attacker to manipulate that parameter and bypass normal administrative access controls, effectively granting unauthorized privileges. The vulnerability aligns with CWE-285 and CWE-639 weaknesses, which describe insufficient authority checks and user-controlled authorization bypass respectively.

The product is Soarkey StudentManagement (also known as 学生信息管理系统). All releases up to the commit identified by e08f7f1d5015af407aa4cca0ada3dea189b4937e are affected. No specific minor versions are listed, so any deployment of that codebase before the upcoming fix is potentially vulnerable. The CPEs indicate that the application is a Java web service hosted on an application server.

The CVSS v3.1 base score is 6.9, reflecting a moderate to high risk due to the remote nature of the exploit. The EPSS score is currently unavailable, and the vulnerability is not yet catalogued in the CISA KEV list. Attackers can trigger the bypass via a remote HTTP request by supplying a crafted 'action' value; public exploitation code indicates that the attack can be performed remotely using the crafted parameter. Given the lack of vendor response and public exploit availability, the threat remains salient for any running instance.