CVE-2026-97647 ningzichun CVE debrief

Who should care

Defenders responsible for student-management-system deployments, especially those with publicly accessible user interfaces, should assess exposure and verify the effectiveness of current authorization controls.

Why it matters

CVE-2026-97647 is a MEDIUM-severity authorization bypass vulnerability in ningzichun student-management-system. Defenders should prioritize verifying exposure, especially for publicly accessible deployments, and assess authorization control effectiveness.

• Defenders should verify exposure of student-management-system deployments
• Assess the effectiveness of current authorization controls
• Monitor for potential exploitation attempts
• Consider implementing compensating controls until an official fix is available

Technical summary

The vulnerability exists in the user/editLog.php file of the ningzichun student-management-system up to version 98760f5711cf6dc8b4adca53a9e207ca49b02ebf. An unknown function in this file is impacted, allowing for authorization bypass through manipulation of the sid, addtime, type, reason, detail, and logdate arguments. The attack can be performed remotely. Defenders should prioritize verifying exposure of student-management-system deployments, especially those with publicly accessible user interfaces, and assess the effectiveness of current authorization controls.

Defensive priority

Defenders should prioritize verifying exposure of student-management-system deployments, especially those with publicly accessible user interfaces, and assess the effectiveness of current authorization controls.

Recommended defensive actions

• Verify exposure of student-management-system deployments, especially those with publicly accessible user interfaces
• Assess the effectiveness of current authorization controls
• Monitor for potential exploitation attempts
• Consider implementing compensating controls until an official fix is available
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its CVSS score of 5.5 and severity of MEDIUM. The exploit has been publicly disclosed but no information on in-the-wild exploitation is provided.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.