Is CVE-2026-86215 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-86215 being exploited in the wild.

How severe is CVE-2026-86215?

Medium severity, with a CVSS score of 4.3, published 6 September 2026.

Which products and versions are affected?

Mstfakts College-Management-System Rolling release; version details not available.

Is there a fix for CVE-2026-86215?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-86215 attacked?

It is attacked over the network.

Am I affected by CVE-2026-86215?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-86215: Mstfakts College-Management-System insufficient session expiration in logout handler

CVE-2026-86215 · Severity: medium · CVSS 4.3 · Published 2026-09-06

Mstfakts College-Management-System is a web-based application that manages student and lecturer accounts for universities. A flaw in the logout function fails to properly invalidate user sessions, allowing anyone with a saved session cookie—including users of shared computers or attackers who captured a token—to continue accessing protected profile data and account information after the legitimate owner has logged out.

Quick answers

Is CVE-2026-86215 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-86215 being exploited in the wild.
How severe is CVE-2026-86215?: Medium severity, with a CVSS score of 4.3, published 6 September 2026.
Which products and versions are affected?: Mstfakts College-Management-System Rolling release; version details not available.
Is there a fix for CVE-2026-86215?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-86215 attacked?: It is attacked over the network.
Am I affected by CVE-2026-86215?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is insufficient session expiration (CWE-613) in the logout handler (Front-end/server.php, lines 125–129). When a user logs out, the application performs only client-side navigation to login.php via JavaScript, but never destroys the PHP session or expires the PHPSESSID cookie. An attacker who possesses a valid session identifier can reuse it to access protected pages, retrieve sensitive profile data (email, GPA, student ID, academic information), and execute authenticated actions. The attack is network-accessible and requires no privileges, but does require that an attacker either has physical access to a shared workstation or previously captured a session cookie. No server-side fixes are publicly available; the project maintainers have not responded to the initial report.

Affected products

Mstfakts College-Management-System Rolling release; version details not available

Timeline

2026-07-20: disclosed: Vulnerability reported via GitHub issue #7
2026-09-06: advisory: CVE-2026-86215 published on NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.