CVE-2026-75460

Name of the Vulnerable Software and Affected Versions XueZhiSi Open Source Exam System versions prior to 3.9.1

Description A privilege escalation issue exists in the teacher-end interface. The endpoint 'POST /api/teacher/user/page/list' allows the requester to fully control the role parameter within the UserPageRequestVM object, potentially allowing a user to gain higher privileges.

Recommendations Update XueZhiSi Open Source Exam System to a version newer than 3.9.0. As a temporary mitigation, restrict access to the 'POST /api/teacher/user/page/list' endpoint or avoid using the role parameter in the UserPageRequestVM until the update is applied.