CVE-2026-100879
zhistaredu StarTraining dataScope Endpoint SysRoleServiceImpl.java checkRoleAllowed authorization
CVSS Score
4.3
EPSS Score
0.0%
EPSS Percentile
0th
A security flaw has been discovered in zhistaredu StarTraining up to 3.8.1. This affects the function checkRoleAllowed of the file SysRoleServiceImpl.java of the component dataScope Endpoint. The manipulation results in missing authorization. The attack may be performed from remote. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
| CWE | CWE-862 CWE-863 |
| Vendor | zhistaredu |
| Product | startraining |
| Published | Sep 27, 2026 |
Stay Ahead of the Next One
Get instant alerts for zhistaredu startraining
Be the first to know when new medium vulnerabilities affecting zhistaredu startraining are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N/E:P/RL:X/RC:C Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Affected Versions
zhistaredu / StarTraining
3.8.0 3.8.1
References
vuldb.com: https://vuldb.com/vuln/410809 vuldb.com: https://vuldb.com/vuln/410809/cti vuldb.com: https://vuldb.com/cve/CVE-2026-100879 vuldb.com: https://vuldb.com/submit/915511 github.com: https://github.com/ArrestX/startraining-advisories/blob/main/advisories/ST-VULN-005-role-crud-missing-preauthorize.md
Credits
🔍 thmanhz (VulDB User) VulDB CNA Team