CVE-2026-35610

PolarLearn is a free and open-source learning program. In 0-PRERELEASE-14 and earlier, setCustomPassword(userId, password) and deleteUser(userId) in the account-management module used an inverted admin check. Because of the inverted condition, authenticated non-admin users were allowed to execute both actions, while real admins were rejected. This is a direct privilege-escalation issue in the application.

CVSS v3 8.8 HIGH

8.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/polarnl/PolarLearn/security/advisories/GHSA-8hww-w7cc-77rj	Exploit Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:polarlearn:polarlearn:-:*:*:*:*:*:*:*

History

26 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) PolarLearn es un programa de aprendizaje gratuito y de código abierto. En 0-PRERELEASE-14 y versiones anteriores, setCustomPassword(userId, password) y deleteUser(userId) en el módulo de gestión de cuentas utilizaban una comprobación de administrador invertida. Debido a la condición invertida, a los usuarios autenticados no administradores se les permitía ejecutar ambas acciones, mientras que los administradores reales eran rechazados. Esto es un problema directo de escalada de privilegios en la aplicación.

Information

Published : 2026-04-07 17:16

Updated : 2026-10-26 21:10

NVD link : CVE-2026-35610

Mitre link : CVE-2026-35610

CVE.ORG link : CVE-2026-35610

JSON object : View

Products Affected

polarlearn

polarlearn

CWE

CWE-285

Improper Authorization

{"id": "CVE-2026-35610", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-35610", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-04-07T18:32:10.510698Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "polarnl", "product": "PolarLearn", "versions": [{"status": "affected", "version": "<= 0-PRERELEASE-14"}]}]}], "published": "2026-04-07T17:16:35.260", "references": [{"url": "https://github.com/polarnl/PolarLearn/security/advisories/GHSA-8hww-w7cc-77rj", "tags": ["Exploit", "Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-285"}]}], "descriptions": [{"lang": "en", "value": "PolarLearn is a free and open-source learning program. In 0-PRERELEASE-14 and earlier, setCustomPassword(userId, password) and deleteUser(userId) in the account-management module used an inverted admin check. Because of the inverted condition, authenticated non-admin users were allowed to execute both actions, while real admins were rejected. This is a direct privilege-escalation issue in the application."}, {"lang": "es", "value": "PolarLearn es un programa de aprendizaje gratuito y de c\u00f3digo abierto. En 0-PRERELEASE-14 y versiones anteriores, setCustomPassword(userId, password) y deleteUser(userId) en el m\u00f3dulo de gesti\u00f3n de cuentas utilizaban una comprobaci\u00f3n de administrador invertida. Debido a la condici\u00f3n invertida, a los usuarios autenticados no administradores se les permit\u00eda ejecutar ambas acciones, mientras que los administradores reales eran rechazados. Esto es un problema directo de escalada de privilegios en la aplicaci\u00f3n."}], "lastModified": "2026-10-26T21:10:00.170", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:polarlearn:polarlearn:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "98DA1036-1EFB-46E7-9C83-425B1C6E6F23"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}