Is CVE-2026-14753 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-14753 being exploited in the wild.

How severe is CVE-2026-14753?

High severity, with a CVSS score of 7.3, published 5 July 2026.

Which products and versions are affected?

Mjperpinosa Stumasy up to 327d1b0f2915ba79d7ef8ebb74553e987609d9be.

Is there a fix for CVE-2026-14753?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-14753 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-14753?

Check whether you run Mjperpinosa Stumasy at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-14753: mjperpinosa stumasy IDOR in Note and Assignment Handlers

CVE-2026-14753 · Severity: high · CVSS 7.3 · Published 2026-07-05

A vulnerability exists in stumasy, a student management and social networking platform. An unauthorized person can remotely view, change, or delete student assignment answers and personal notes without needing a password. This could lead to the theft of student work, falsification of academic records, and loss of private data.

Technologies: Mjperpinosa Stumasy. Vendors: Mjperpinosa.

Quick answers

Is CVE-2026-14753 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-14753 being exploited in the wild.
How severe is CVE-2026-14753?: High severity, with a CVSS score of 7.3, published 5 July 2026.
Which products and versions are affected?: Mjperpinosa Stumasy up to 327d1b0f2915ba79d7ef8ebb74553e987609d9be.
Is there a fix for CVE-2026-14753?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-14753 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-14753?: Check whether you run Mjperpinosa Stumasy at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is an Insecure Direct Object Reference (IDOR) located in the Note and Assignment Handlers of the stumasy student management system. Specifically, endpoints such as update_assignment_answer.php and update_scratch_data.php accept record IDs (e.g., assignment_item_id, scratch_data_id) via POST requests without verifying user authentication or record ownership. An unauthenticated remote attacker can exploit this by supplying arbitrary IDs to perform unauthorized CRUD operations on the database. The root cause is the lack of session validation and ownership checks in the Notes_controller class. As of the advisory date, the project has not responded to the issue report, and no patch is available.

Affected products

mjperpinosa stumasy up to 327d1b0f2915ba79d7ef8ebb74553e987609d9be

Timeline

2026-06-05: disclosed: Issue reported to the developer via GitHub
2026-07-05: advisory: CVE published to NVD dataset

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.