PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-10272 a4m4 CVE debrief

A vulnerability in a4m4 Student-Management-System up to commit f0c5f6842c5e8c431ff02b5260a565ca844df3a0 allows improper authorization via the sid parameter in admin/deleteform.php. The attack can be launched remotely and the exploit has been publicly disclosed. The project uses rolling releases and has not yet responded to the issue report.

Vendor
a4m4
Product
Student-Management-System
CVSS
MEDIUM 5.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-01
Original CVE updated
2026-07-22
Advisory published
2026-06-01
Advisory updated
2026-07-22

Who should care

Organizations running a4m4 Student-Management-System instances, particularly those exposing administrative interfaces to broader networks. Security teams monitoring PHP-based student management applications and developers maintaining forked or customized versions of this project.

Technical summary

The vulnerability exists in admin/deleteform.php where manipulation of the sid parameter leads to improper authorization. The application fails to properly verify that the requesting user has sufficient privileges before executing deletion operations. As a rolling release project, specific patched version numbers are not available. The attack vector is network-based with low attack complexity, requiring no privileges or user interaction. The vulnerability has confidentiality impact none, integrity impact low, and availability impact low per the CVSS 4.0 scoring.

Defensive priority

medium

Recommended defensive actions

  • Restrict access to admin/deleteform.php to authorized administrative users only
  • Implement proper authorization checks on the sid parameter before processing deletion requests
  • Apply input validation and session verification for all administrative functions
  • Monitor for unauthorized access attempts to admin/deleteform.php
  • Consider implementing multi-factor authentication for administrative interfaces
  • Review and audit other administrative endpoints for similar authorization weaknesses

Evidence notes

The vulnerability is documented in the NVD record with Vuldb as the CNA. The affected file is admin/deleteform.php with the sid parameter as the attack vector. CVSS 4.0 vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. CWE-266 (Incorrect Privilege Assignment) and CWE-285 (Improper Authorization) are identified.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-10272 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-10272

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-10272 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-10272

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.