Executive brief
XueZhiSi is an open-source online exam system used by educational institutions to manage student assessments and teacher accounts. A vulnerability in the user deletion endpoint allows authenticated teacher accounts to delete administrator accounts without authorization, effectively enabling a lower-privileged user to remove higher-privileged accounts and disrupt system administration.
Technical details
The POST /api/teacher/user/delete/{id} endpoint in XueZhiSi Open Source Exam System versions 3.9.0 and earlier contains a vertical privilege escalation vulnerability caused by missing authorization checks. The endpoint accepts a user ID parameter and performs a deletion operation (getUserById, setDeleted, updateByIdFilter) without verifying whether the authenticated user has permission to delete the target user account. An authenticated teacher (role=2) can exploit this to delete administrator accounts (role=3), a capability they should not possess. The vulnerability requires authentication but no additional preconditions; the attacker must only be a legitimate teacher user with network access to the application.
Affected products
- XueZhiSi Open Source Exam System 3.9.0 and earlier
Timeline
- 2026-08-31: disclosed
- 2026-06-24: other: Patch proposed via GitHub pull request