Authorization Bypass in LMS Exam Deletion Function

A vulnerability has been found in SourceCodester Syllabus-Aligned Learning Management & Examination System 1.0. Impacted is an unknown function of the file delete_exam.php. The manipulation of the argument ID leads to authorization bypass. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used.

Casky was already ahead

This CVE exploits attack patterns that Casky's 283matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

CVE-2026-86277 represents a critical authorization bypass vulnerability in SourceCodester's Syllabus-Aligned Learning Management & Examination System version 1.0, specifically within the delete_exam.php endpoint. By manipulating the ID parameter, unauthenticated or low-privileged attackers can delete exam records without proper permission checks, potentially disrupting educational operations and compromising data integrity. This vulnerability affects any organization running this LMS system, from K-12 institutions to corporate training platforms, with particular risk to those storing sensitive assessment data. The remote exploitability and public disclosure of this flaw elevate the urgency, as threat actors can immediately leverage this weakness to cause operational disruption or gain unauthorized access to examination systems.

Casky's 283 matched skills, powered by Claude AI's extended reasoning capabilities, detect this vulnerability pattern by mapping it against MITRE ATT&CK techniques TA0004 (Privilege Escalation) and TA0006 (Credential Access). Practitioners using Casky would identify attack indicators such as: suspicious delete requests to delete_exam.php with manipulated or sequential ID parameters, authorization errors followed by successful deletions, and lateral movement attempts where users access exam deletion functions outside their assigned roles. The platform's security skills enable detection of the underlying CWE-285 (Improper Authorization) and CWE-639 (Authorization Bypass Through User-Controlled Key) weaknesses by flagging missing authentication checks, inadequate session validation, and ID parameter tampering patterns. Practitioners would see these findings categorized as privilege escalation attempts with high confidence, allowing rapid response and remediation before exam data loss occurs.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

283 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-86277.

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

Access with Stolen Session Cookie

identity access management · low

Run

MITRE ATT&CK Techniques

TA0004 TA0006

Investigate the attack patterns behind CVE-2026-86277

Casky has 283 skills that investigate the attack patterns behind CVE-2026-86277. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn