# CVE-2026-90787: Soarkey StudentManagement privilege escalation in registration

Source: https://junglewise.ai/threats/cve-2026-90787-soarkey-studentmanagement-privilege-escalation-in-registration  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-14. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-90787 · Severity: high · CVSS 7.3 · Published 2026-09-14

Soarkey StudentManagement is a Java web application used for managing student information. A vulnerability in the user registration function allows attackers to remotely register accounts with arbitrary privilege levels (such as administrator), bypassing normal role assignment controls. This could enable unauthorized access to sensitive student records and system functions.

Technologies: [Soarkey StudentManagement](https://junglewise.ai/threats/technologies/studentmanagement). Vendors: [Soarkey](https://junglewise.ai/threats/vendors/soarkey).

## Quick answers

**Is CVE-2026-90787 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-90787 being exploited in the wild.

**How severe is CVE-2026-90787?** High severity, with a CVSS score of 7.3, published 14 September 2026.

**Which products and versions are affected?** Soarkey StudentManagement up to commit e08f7f1d5015af407aa4cca0ada3dea189b4937e.

**Is there a fix for CVE-2026-90787?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-90787 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-90787?** Check whether you run Soarkey StudentManagement at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability exists in the RegisterServlet.doPost method within the registration workflow (register.html component). The registration endpoint improperly validates the "level" parameter, allowing clients to directly manipulate and set their own privilege level during registration. An attacker can craft a malicious registration request specifying a high privilege level (e.g., administrator) without authentication. The application lacks server-side enforcement of privilege levels, accepting the client-supplied value. This is a privilege escalation vulnerability accessible remotely without authentication. No patched version is currently available, as the project uses commit hashes for versioning and has not responded to the issue report.

## Affected products

- Soarkey StudentManagement up to commit e08f7f1d5015af407aa4cca0ada3dea189b4937e

## Timeline

- 2026-09-14: disclosed
- other: Exploit is publicly available

## References

- [https://github.com/Soarkey/StudentManagement/](https://github.com/Soarkey/StudentManagement/)
- [https://github.com/Soarkey/StudentManagement/issues/35](https://github.com/Soarkey/StudentManagement/issues/35)

## Related threats

- [Soarkey StudentManagement authorization bypass in Administrative Servlet](https://junglewise.ai/threats/cve-2026-82621-soarkey-studentmanagement-authorization-bypass-in-administrative)
- [Soarkey StudentManagement SQL injection in course ranking](https://junglewise.ai/threats/cve-2026-82620-soarkey-studentmanagement-sql-injection-in-course-ranking)