CVE-2026-82621

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-82621", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "state": "PUBLISHED", "assignerShortName": "VulDB", "dateReserved": "2026-08-30T08:00:04.628Z", "datePublished": "2026-08-31T05:45:09.136Z", "dateUpdated": "2026-08-31T14:32:31.693Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-08-31T05:45:09.136Z"}, "title": "Soarkey StudentManagement/\u5b66\u751f\u4fe1\u606f\u7ba1\u7406\u7cfb\u7edf Administrative Servlet AdminDao.java AdminDao.doGet authorization", "problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-639", "lang": "en", "description": "Authorization Bypass"}]}, {"descriptions": [{"type": "CWE", "cweId": "CWE-285", "lang": "en", "description": "Improper Authorization"}]}], "affected": [{"vendor": "Soarkey", "product": "StudentManagement", "versions": [{"version": "e08f7f1d5015af407aa4cca0ada3dea189b4937e", "status": "affected"}], "cpes": ["cpe:2.3:a:soarkey:studentmanagement:*:*:*:*:*:*:*:*"], "modules": ["Administrative Servlet"]}, {"vendor": "Soarkey", "product": "\u5b66\u751f\u4fe1\u606f\u7ba1\u7406\u7cfb\u7edf", "versions": [{"version": "e08f7f1d5015af407aa4cca0ada3dea189b4937e", "status": "affected"}], "cpes": ["cpe:2.3:a:soarkey:_:*:*:*:*:*:*:*:*"], "modules": ["Administrative Servlet"]}], "descriptions": [{"lang": "en", "value": "A weakness has been identified in Soarkey StudentManagement and \u5b66\u751f\u4fe1\u606f\u7ba1\u7406\u7cfb\u7edf up to e08f7f1d5015af407aa4cca0ada3dea189b4937e. This impacts the function AdminDao.doGet of the file code/src/service/AdminDao.java of the component Administrative Servlet. Executing a manipulation of the argument action can lead to authorization bypass. It is possible to launch the attack remotely. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet."}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 6.9, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P", "baseSeverity": "MEDIUM"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 7.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R", "baseSeverity": "HIGH"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 7.3, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R", "baseSeverity": "HIGH"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 7.5, "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR"}}], "timeline": [{"time": "2026-08-30T00:00:00.000Z", "lang": "en", "value": "Advisory disclosed"}, {"time": "2026-08-30T02:00:00.000Z", "lang": "en", "value": "VulDB entry created"}, {"time": "2026-08-30T10:05:20.000Z", "lang": "en", "value": "VulDB entry last update"}], "credits": [{"lang": "en", "value": "soulinda (VulDB User)", "type": "reporter"}, {"lang": "en", "value": "VulDB CNA Team", "type": "coordinator"}], "references": [{"url": "https://vuldb.com/vuln/397121", "name": "VDB-397121 | Soarkey StudentManagement/\u5b66\u751f\u4fe1\u606f\u7ba1\u7406\u7cfb\u7edf Administrative Servlet AdminDao.java AdminDao.doGet authorization", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/vuln/397121/cti", "name": "VDB-397121 | CTI Indicators (IOB, IOC, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/cve/CVE-2026-82621", "name": "CVE-2026-82621 | CVE Analysis and Report", "tags": ["third-party-advisory"]}, {"url": "https://vuldb.com/submit/893104", "name": "Submit #893104 | Soarkey StudentManagement e08f7f1d5015af407aa4cca0ada3dea189b4937e Authorization Bypass", "tags": ["third-party-advisory"]}, {"url": "https://github.com/Soarkey/StudentManagement/issues/32", "tags": ["exploit", "issue-tracking"]}, {"url": "https://github.com/Soarkey/StudentManagement/", "tags": ["product"]}], "x_generator": ["VulDB PVTS v202608"]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-31T14:32:22.171781Z", "id": "CVE-2026-82621", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-31T14:32:31.693Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-82621", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-31T14:32:22.171781Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-31T14:32:28.669Z"}}], "cna": {"title": "Soarkey StudentManagement/\u5b66\u751f\u4fe1\u606f\u7ba1\u7406\u7cfb\u7edf Administrative Servlet AdminDao.java AdminDao.doGet authorization", "credits": [{"lang": "en", "type": "reporter", "value": "soulinda (VulDB User)"}, {"lang": "en", "type": "coordinator", "value": "VulDB CNA Team"}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 6.9, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 7.3, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 7.3, "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 7.5, "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR"}}], "affected": [{"cpes": ["cpe:2.3:a:soarkey:studentmanagement:*:*:*:*:*:*:*:*"], "vendor": "Soarkey", "modules": ["Administrative Servlet"], "product": "StudentManagement", "versions": [{"status": "affected", "version": "e08f7f1d5015af407aa4cca0ada3dea189b4937e"}]}, {"cpes": ["cpe:2.3:a:soarkey:_:*:*:*:*:*:*:*:*"], "vendor": "Soarkey", "modules": ["Administrative Servlet"], "product": "\u5b66\u751f\u4fe1\u606f\u7ba1\u7406\u7cfb\u7edf", "versions": [{"status": "affected", "version": "e08f7f1d5015af407aa4cca0ada3dea189b4937e"}]}], "timeline": [{"lang": "en", "time": "2026-08-30T00:00:00.000Z", "value": "Advisory disclosed"}, {"lang": "en", "time": "2026-08-30T02:00:00.000Z", "value": "VulDB entry created"}, {"lang": "en", "time": "2026-08-30T10:05:20.000Z", "value": "VulDB entry last update"}], "references": [{"url": "https://vuldb.com/vuln/397121", "name": "VDB-397121 | Soarkey StudentManagement/\u5b66\u751f\u4fe1\u606f\u7ba1\u7406\u7cfb\u7edf Administrative Servlet AdminDao.java AdminDao.doGet authorization", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/vuln/397121/cti", "name": "VDB-397121 | CTI Indicators (IOB, IOC, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/cve/CVE-2026-82621", "name": "CVE-2026-82621 | CVE Analysis and Report", "tags": ["third-party-advisory"]}, {"url": "https://vuldb.com/submit/893104", "name": "Submit #893104 | Soarkey StudentManagement e08f7f1d5015af407aa4cca0ada3dea189b4937e Authorization Bypass", "tags": ["third-party-advisory"]}, {"url": "https://github.com/Soarkey/StudentManagement/issues/32", "tags": ["exploit", "issue-tracking"]}, {"url": "https://github.com/Soarkey/StudentManagement/", "tags": ["product"]}], "x_generator": ["VulDB PVTS v202608"], "descriptions": [{"lang": "en", "value": "A weakness has been identified in Soarkey StudentManagement and \u5b66\u751f\u4fe1\u606f\u7ba1\u7406\u7cfb\u7edf up to e08f7f1d5015af407aa4cca0ada3dea189b4937e. This impacts the function AdminDao.doGet of the file code/src/service/AdminDao.java of the component Administrative Servlet. Executing a manipulation of the argument action can lead to authorization bypass. It is possible to launch the attack remotely. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-639", "description": "Authorization Bypass"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-285", "description": "Improper Authorization"}]}], "providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-08-31T05:45:09.136Z"}}}, "cveMetadata": {"cveId": "CVE-2026-82621", "state": "PUBLISHED", "dateUpdated": "2026-08-31T14:32:31.693Z", "dateReserved": "2026-08-30T08:00:04.628Z", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "datePublished": "2026-08-31T05:45:09.136Z", "assignerShortName": "VulDB"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"cpes": ["cpe:2.3:a:soarkey:studentmanagement:*:*:*:*:*:*:*:*"], "modules": ["Administrative Servlet"], "product": "StudentManagement", "vendor": "Soarkey", "versions": [{"status": "affected", "version": "e08f7f1d5015af407aa4cca0ada3dea189b4937e"}]}, {"cpes": ["cpe:2.3:a:soarkey:_:*:*:*:*:*:*:*:*"], "modules": ["Administrative Servlet"], "product": "\u5b66\u751f\u4fe1\u606f\u7ba1\u7406\u7cfb\u7edf", "vendor": "Soarkey", "versions": [{"status": "affected", "version": "e08f7f1d5015af407aa4cca0ada3dea189b4937e"}]}], "source": "cna@vuldb.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A weakness has been identified in Soarkey StudentManagement and \u5b66\u751f\u4fe1\u606f\u7ba1\u7406\u7cfb\u7edf up to e08f7f1d5015af407aa4cca0ada3dea189b4937e. This impacts the function AdminDao.doGet of the file code/src/service/AdminDao.java of the component Administrative Servlet. Executing a manipulation of the argument action can lead to authorization bypass. It is possible to launch the attack remotely. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet."}], "id": "CVE-2026-82621", "lastModified": "2026-08-31T20:56:08.800", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "HIGH", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 7.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "cna@vuldb.com", "type": "Secondary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 7.3, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.4, "source": "cna@vuldb.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "PROOF_OF_CONCEPT", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cna@vuldb.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-82621", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-08-31T14:32:22.171781Z", "version": "2.0.3"}}]}, "published": "2026-08-31T06:17:08.280", "references": [{"source": "cna@vuldb.com", "url": "https://github.com/Soarkey/StudentManagement/"}, {"source": "cna@vuldb.com", "url": "https://github.com/Soarkey/StudentManagement/issues/32"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/cve/CVE-2026-82621"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/submit/893104"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/397121"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/397121/cti"}], "sourceIdentifier": "cna@vuldb.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-285"}, {"lang": "en", "value": "CWE-639"}], "source": "cna@vuldb.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "e08f7f1d5015af407aa4cca0ada3dea189b4937e"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "StudentManagement", "source": "cna", "vendor": "Soarkey"}, "product": "studentmanagement", "vendor": "soarkey"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "e08f7f1d5015af407aa4cca0ada3dea189b4937e"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "\u5b66\u751f\u4fe1\u606f\u7ba1\u7406\u7cfb\u7edf", "source": "cna", "vendor": "Soarkey"}, "product": "\u5b66\u751f\u4fe1\u606f\u7ba1\u7406\u7cfb\u7edf", "vendor": "soarkey"}], "created": "2026-08-31T08:00:11.723350+00:00", "updated": "2026-08-31T11:18:57.012700+00:00", "vendors": ["soarkey", "soarkey$PRODUCT$studentmanagement", "soarkey$PRODUCT$\u5b66\u751f\u4fe1\u606f\u7ba1\u7406\u7cfb\u7edf"]}