Is CVE-2026-11532 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-11532 being exploited in the wild.

How severe is CVE-2026-11532?

Medium severity, with a CVSS score of 6.3, published 8 June 2026.

Which products and versions are affected?

imvks786 student_management_system up to 9599b560ad3c3b83e75d328b76bedcd489ef1f46.

Is there a fix for CVE-2026-11532?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-11532 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-11532?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-11532: imvks786 student_management_system improper access control in Student Record Handler

CVE-2026-11532 · Severity: medium · CVSS 6.3 · Published 2026-06-08

A vulnerability in the imvks786 Student Management System allows users with low-level 'view-only' permissions to perform administrative actions. This software is used to manage student records, and an exploit allows unauthorized users to add or delete student data. This could lead to the loss of accurate student records or the unauthorized modification of sensitive educational information.

Quick answers

Is CVE-2026-11532 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-11532 being exploited in the wild.
How severe is CVE-2026-11532?: Medium severity, with a CVSS score of 6.3, published 8 June 2026.
Which products and versions are affected?: imvks786 student_management_system up to 9599b560ad3c3b83e75d328b76bedcd489ef1f46.
Is there a fix for CVE-2026-11532?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-11532 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-11532?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An improper access control vulnerability (CWE-284/CWE-266) exists in the Student Record Handler component of the imvks786 student_management_system. The application relies on client-side UI restrictions (hiding buttons) rather than server-side validation to enforce role-based access control. Specifically, the 'add.php' and 'see.php' endpoints only verify that a user is logged in, failing to check if the user possesses 'ADMIN' or 'EDIT' privileges. A remote authenticated attacker with 'VIEW' permissions can bypass these restrictions by sending direct POST or GET requests to these endpoints to add or delete student records. As of the advisory date, no patch has been released by the maintainer.

Affected products

imvks786 student_management_system up to 9599b560ad3c3b83e75d328b76bedcd489ef1f46

Timeline

2026-05-25: disclosed: Issue reported to the project maintainer via GitHub
2026-06-08: advisory: CVE published by VulDB

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.