The vulnerability resides in an undisclosed function of the Student Management System’s Dashboard component, allowing remote actors to manipulate request parameters and bypass the intended access controls. Injecting crafted payloads can grant an authenticated or unauthenticated attacker unauthorized entry to secure sections of the application, potentially exposing user data and administrative functions. The weakness can be classified against CWE‑266 and CWE‑284, indicating a failure to enforce authorization policies.

Products affected are those released before commit 56ba287f2e9031523ccb4244cb6e3fe530e4e5d5 of the Sambitraj Student Management System. Because the project follows a rolling release model, exact version numbers are not tied to discrete releases; thus any instance deployed before the fix will remain vulnerable until it is updated or the commit is superseded.

The CVSS score of 6.9 places the flaw in the medium severity range. No EPSS data is available, and the vulnerability is not listed in CISA’s KEV catalog, but the remote exploitation potential and lack of an immediate public patch raise the overall risk. Attackers could exploit this remotely over the network, and the absence of vendor response suggests that mitigation must be performed by the user until an official patch is released.