CVE-2026-100878

Name of the Vulnerable Software and Affected Versions zhistaredu StarTraining versions prior to 3.8.2

Description An authorization bypass exists in the authRole endpoint. A remote attacker can manipulate the userId or roleIds arguments within the SysUser.isAdmin() function to bypass security checks.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. Restrict access to the authRole endpoint to minimize the risk of exploitation.