Thmanhz

**Name of the Vulnerable Software and Affected Versions** zhistaredu StarTraining versions prior to 3.8.2 **Description** An authorization bypass exists in the authRole endpoint. A remote attacker can manipulate the `userId` or `roleIds` arguments within the `SysUser.isAdmin()` function to bypass security checks. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. Restrict access to the authRole endpoint to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** zhistaredu StarTraining versions prior to 3.8.2 **Description** A remote security flaw exists in the `dataScope` endpoint within the `SysRoleServiceImpl.java` file. The issue resides in the `checkRoleAllowed()` function, where improper manipulation can lead to missing authorization, allowing unauthorized access to restricted functionality. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, restrict access to the `dataScope` endpoint to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** zhistaredu StarTraining versions prior to 3.8.2 **Description** A weakness in the Upload Endpoint component, specifically within the file `du-common/src/main/java/com/edu/common/utils/file/MimeTypeUtils.java`, allows for remote cross-site scripting. This occurs through the manipulation of the `File` argument. Cross-site scripting is a technique where malicious scripts are injected into trusted websites. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

A security vulnerability has been detected in zhistaredu StarTraining up to 3.8.1. This issue affects some unknown processing of the file application.yml. Such manipulation of the argument xss.enabled leads to cross site scripting. It is possible to launch the attack remotely. Attacks of this nature are highly complex. The exploitability is assessed as difficult. The exploit has been disclosed publicly and may be used. Not independently exploitable: a defense-in-depth absence that amplifies CVE-2026-100880. The vendor was contacted early about this disclosure but did not respond in any way.