CVE-2026-75458

XueZhiSi Open Source Exam System versions 3.9.0 and earlier contain a vertical privilege escalation vulnerability in the teacher-end endpoint POST /api/teacher/user/delete/{id} . The endpoint accepts a user ID and performs a deletion sequence (getUserById, setDeleted, updateByIdFilter) without va...