Executive brief
College Notes Gallery Management System is a web application for managing academic notes and course materials. A flaw in the user registration process allows unauthenticated attackers to create administrative accounts by manipulating the role parameter, gaining full control over the system including user management and content approval functions.
Technical details
This is a broken access control vulnerability in the signup.php registration endpoint. The backend directly trusts and stores the client-supplied role parameter without server-side validation or allowlist checking. Although the frontend only presents "teacher" and "student" options, an unauthenticated attacker can intercept the signup POST request and modify the role field to "admin" to create a privileged account. No authentication or authorization checks are enforced during registration. An attacker can then log in with the newly created admin account and access all administrative functions, including user management, note approval, and system configuration. The vulnerability is trivial to exploit and requires no preconditions beyond network access to the signup page.
Affected products
- SourceCodester College Notes Gallery Management System 1.0
Timeline
- 2026-08-13: disclosed: Vulnerability disclosed on GitHub
- 2026-09-15: advisory: CVE-2026-90856 published