Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
2.1
CVE-2026-100878: StarTraining lets attackers gain admin rights
CVE-2026-100878 · published 21 days ago
Summary
In StarTraining versions up to 3.8.1, a check that decides whether a user is an administrator can be fooled by sending specially crafted user or role information. This means someone on the network could obtain admin privileges without proper permission. Apply the vendor's latest update or patch, and limit who can call the affected service while monitoring for unusual activity.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| zhistaredu | startraining | 3.8.0 |
Original advisory text
zhistaredu StarTraining authRole Endpoint SysUser.java SysUser.isAdmin authorization
A vulnerability was identified in zhistaredu StarTraining up to 3.8.1. Affected by this issue is the function SysUser.isAdmin of the file edu-common/src/main/java/com/edu/common/core/domain/entity/SysUser.java of the component authRole Endpoint. The manipulation of the argument userId/roleIds leads to authorization bypass. The attack is possible to be carried out remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Severity
2.1
Low
Type
CWE-639Authorization Bypass Through User-Controlled Key
CWE-285Improper Authorization
Timeline
Published27 Sep 2026
Updated19 Oct 2026
First seen27 Sep 2026
Track software like this
Free during beta