The vulnerability is located in the register function of the auth.php script within SourceCodester Syllabus‑Aligned Learning Management & Examination System 1.0. An attacker can manipulate the role argument during registration, causing the application to grant elevated privileges to a user that should not have them. This flaw allows an unauthenticated or low‑privileged user to gain administrative or higher level access, directly violating the principle of least privilege. The weakness is a classic example of improper authorization (CWE‑266 and CWE‑269).

The affected product is SourceCodester Syllabus‑Aligned Learning Management & Examination System version 1.0. No other versions are explicitly mentioned. The flaw resides in the auth.php registration endpoint. The vendor is SourceCodester.

The CVSS base score of 6.9 indicates a moderate severity, and the EPSS score is not available, but a publicly available exploit has been documented, indicating that exploitation is likely if the system is exposed. The issue can be exploited remotely through a web request to the registration URL, manipulating the role parameter. The vulnerability is not listed in the CISA KEV catalog, but the public nature of the exploit creates a risk for any deployed instance that has not been patched.