GHSA-xfx2-prg5-jq3g
High · 8.3INSATutorat has an authorization bypass vulnerability in its /api/admin/* endpoints
CVSS
8.3
EPSS
—
Published
Mar 1, 2026
CISA due date
—
The record
An authorization bypass vulnerability was discovered in the administration pages of the tutoring application. When a standard user (logged in but without administrator privileges) attempts to access a resource under /api/admin/, the system detects the error but does not block the request. As a result, sensitive data is still transmitted by the server in the request (GET), and modification actions such as campaign creation (POST) are executed successfully despite the FORBIDDEN error message. All /api/admin/* endpoints are affected.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-85543 Some Wi-Fi series camera products have insufficient permission validation on certain… CWE-285
- CVE-2026-21097 Improper authentication in ActivityTaskManagerService prior to SMR Sep-2026 Release 1… CWE-285
- CVE-2026-86804 A vulnerability was identified in seakee CPA-Manager-Plus up to 1.11.10. CWE-285
- CVE-2026-86277 A vulnerability has been found in SourceCodester Syllabus-Aligned Learning Management &… CWE-285
- CVE-2026-86283 MISP's UiBeta theme collection view (app/View/Themed/UiBeta/Collections/view.ctp)… CWE-285
- CVE-2026-86212 A vulnerability has been found in Open5GS 2.7.7/2.8.0. CWE-285
- CVE-2026-86183 A vulnerability was identified in diem-project diem up to 5.1.3. CWE-285
- CVE-2026-53602 nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. CWE-285