# CVE-2026-9562: sambitraj STUDENT-MANAGEMENT-SYSTEM broken access control in dashboards

Source: https://junglewise.ai/threats/cve-2026-9562-sambitraj-student-management-system-broken-access-control-in  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-26. Updated: 2026-05-26  
License: CC BY 4.0 with a link back

CVE-2026-9562 · Severity: high · CVSS 7.3 · Published 2026-05-26

A vulnerability in the Student Management System (SMS) allows unauthorized individuals to access administrative dashboards and perform management tasks without logging in. This software is used by schools to track student data, grades, and teacher information. An attacker could exploit this to view sensitive student records or modify and delete school data, potentially leading to significant data breaches or operational disruption.

Technologies: [Sambitraj Student Management System](https://junglewise.ai/threats/technologies/student-management-system). Vendors: [Sambitraj](https://junglewise.ai/threats/vendors/sambitraj).

## Quick answers

**Is CVE-2026-9562 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-9562 being exploited in the wild.

**How severe is CVE-2026-9562?** High severity, with a CVSS score of 7.3, published 26 May 2026.

**Which products and versions are affected?** Sambitraj Student Management System up to 56ba287f2e9031523ccb4244cb6e3fe530e4e5d5.

**Is there a fix for CVE-2026-9562?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-9562 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-9562?** Check whether you run Sambitraj Student Management System at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A broken access control vulnerability exists in the sambitraj STUDENT-MANAGEMENT-SYSTEM through commit 56ba287. The application fails to implement session validation checks across multiple PHP scripts, including admin_dashboard.php, student_dashboard.php, and teacher_dashboard.php, as well as CRUD operation scripts like add_student.php and delete_student.php. While these files initiate a session via session_start(), they do not verify the existence of a valid session variable (e.g., $_SESSION['email']). A remote, unauthenticated attacker can bypass the login mechanism by directly requesting these URLs, gaining full access to administrative, teacher, and student functionalities. As of the advisory date, no patch has been released by the maintainer.

## Affected products

- sambitraj STUDENT-MANAGEMENT-SYSTEM up to 56ba287f2e9031523ccb4244cb6e3fe530e4e5d5

## Timeline

- 2026-04-29: disclosed: Issue reported on GitHub by user duckpigdog
- 2026-05-26: advisory: NVD/VulDB advisory published

## References

- [https://github.com/sambitraj/STUDENT-MANAGEMENT-SYSTEM/](https://github.com/sambitraj/STUDENT-MANAGEMENT-SYSTEM/)
- [https://github.com/sambitraj/STUDENT-MANAGEMENT-SYSTEM/issues/1](https://github.com/sambitraj/STUDENT-MANAGEMENT-SYSTEM/issues/1)
- [https://github.com/sambitraj/STUDENT-MANAGEMENT-SYSTEM/issues/1](https://github.com/sambitraj/STUDENT-MANAGEMENT-SYSTEM/issues/1)
- [https://vuldb.com/submit/815536](https://vuldb.com/submit/815536)
- [https://vuldb.com/vuln/365625](https://vuldb.com/vuln/365625)
- [https://vuldb.com/vuln/365625/cti](https://vuldb.com/vuln/365625/cti)

## Related threats

- [sambitraj Student Management System cleartext password storage](https://junglewise.ai/threats/cve-2026-82699-sambitraj-student-management-system-cleartext-password-storage)
- [sambitraj Student-Management-System use of default password](https://junglewise.ai/threats/cve-2026-82698-sambitraj-student-management-system-use-of-default-password)
- [sambitraj Student-Management-System insecure session cookie in login](https://junglewise.ai/threats/cve-2026-82697-sambitraj-student-management-system-insecure-session-cookie-in)
- [sambitraj Student Management System authorization bypass in dashboard](https://junglewise.ai/threats/cve-2026-82553-sambitraj-student-management-system-authorization-bypass-in)
- [sambitraj Student Management System SQL injection in management mutation handlers](https://junglewise.ai/threats/cve-2026-78057-sambitraj-student-management-system-sql-injection-in-management)