# CVE-2026-11476: Kushan2k student-management-system improper authorization in Profile Update Endpoint

Source: https://junglewise.ai/threats/cve-2026-11476-kushan2k-student-management-system-improper-authorization-in  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-08. Updated: 2026-06-08  
License: CC BY 4.0 with a link back

CVE-2026-11476 · Severity: medium · CVSS 6.3 · Published 2026-06-08

A security flaw exists in the Kushan2k Student Management System, a tool used for managing educational records. An unauthorized person can bypass security checks to modify administrator profile information, such as email addresses and passwords. This could allow an attacker to take over administrative accounts, lock out legitimate users, or gain full control over the system and its data.

## Quick answers

**Is CVE-2026-11476 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-11476 being exploited in the wild.

**How severe is CVE-2026-11476?** Medium severity, with a CVSS score of 6.3, published 8 June 2026.

**Which products and versions are affected?** Kushan2k student-management-system up to f16a4ceaddd6729c4b306ed4641cda3176c1ef2a.

**Is there a fix for CVE-2026-11476?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-11476 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-11476?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The 'edit-admin' function in 'controllers/AdminController.php' fails to implement session-based authentication checks (e.g., verifying $_SESSION['isadmin']). This allows unauthenticated remote attackers to trigger administrative profile updates via POST requests. Additionally, the 'config/User.php' component constructs SQL queries using direct string concatenation of user-supplied parameters like 'id' and 'email', introducing a SQL injection vulnerability. An attacker can exploit these combined issues to modify administrator credentials or execute arbitrary SQL commands to compromise the database. As of the advisory date, the vendor has not responded to the issue report.

## Affected products

- Kushan2k student-management-system up to f16a4ceaddd6729c4b306ed4641cda3176c1ef2a

## Timeline

- 2026-05-20: disclosed: Issue reported on GitHub repository
- 2026-06-08: advisory: CVE published by VulDB/NVD

## References

- [https://github.com/Kushan2k/student-management-system/](https://github.com/Kushan2k/student-management-system/)
- [https://github.com/Kushan2k/student-management-system/issues/3](https://github.com/Kushan2k/student-management-system/issues/3)
- [https://vuldb.com/cve/CVE-2026-11476](https://vuldb.com/cve/CVE-2026-11476)
- [https://vuldb.com/submit/833945](https://vuldb.com/submit/833945)
- [https://vuldb.com/vuln/369096](https://vuldb.com/vuln/369096)
- [https://vuldb.com/vuln/369096/cti](https://vuldb.com/vuln/369096/cti)