# CVE-2026-86214: Mstfakts College-Management-System improper authentication in registration

Source: https://junglewise.ai/threats/cve-2026-86214-mstfakts-college-management-system-improper-authentication-in  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-06. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-86214 · Severity: high · CVSS 7.3 · Published 2026-09-06

The College-Management-System is a web-based platform for managing student and faculty accounts and records. The registration form accepts any email address without verifying email ownership or user eligibility, allowing attackers to claim pre-existing student or lecturer identities. Once claimed, an attacker gains access to sensitive academic and personal records including grades, transcripts, and scholarship details, and can modify profile data such as club memberships.

## Quick answers

**Is CVE-2026-86214 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-86214 being exploited in the wild.

**How severe is CVE-2026-86214?** High severity, with a CVSS score of 7.3, published 6 September 2026.

**Which products and versions are affected?** Mstfakts College-Management-System Rolling release (unpatched as of 2026-09-06).

**Is there a fix for CVE-2026-86214?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-86214 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-86214?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is an improper authentication flaw (CWE-287) in the registration and login flow. The application maintains separate login records (visitor table) from business identities (student and lecturer tables), linking them solely by email address. The registration form accepts arbitrary emails without email verification or invitation validation and only checks whether the email exists in the visitor table; it fails to verify that the applicant is entitled to claim the supplied identity. An unauthenticated attacker can remotely register using a pre-provisioned student or lecturer email, then authenticate with their attacker-chosen password to gain full access to that identity's protected records and permissions. The application then treats the authenticated email as the authoritative student/lecturer identity. No patch has been released; the project uses rolling release and has not responded to the issue report.

## Affected products

- Mstfakts College-Management-System Rolling release (unpatched as of 2026-09-06)

## Timeline

- 2026-07-20: disclosed: Issue reported on GitHub
- 2026-09-06: advisory: CVE-2026-86214 published
- 2026-09-06: other: Project has not yet responded to vulnerability report

## References

- [https://github.com/Mstfakts/College-Management-System/issues/6](https://github.com/Mstfakts/College-Management-System/issues/6)
- [https://vuldb.com/cve/CVE-2026-86214](https://vuldb.com/cve/CVE-2026-86214)