A critical privilege escalation vulnerability in PolarLearn allows non-administrative users to perform unauthorized account management tasks, potentially leading to a complete system compromise.

This is an improper authorization flaw (CWE-285) within the account-management module. The functions setCustomPassword and deleteUser contain an inverted administrative check, which permits any authenticated user to execute these actions while simultaneously blocking legitimate administrators.

The ability for low-privileged users to modify passwords or delete any account in the system represents a total loss of confidentiality, integrity, and availability. With a CVSS score of 8.8, this vulnerability poses a high risk to organizational data security and system stability, as malicious actors could seize control of administrative accounts or disrupt educational operations entirely.

Immediate Action: Monitor the official PolarLearn GitHub repository for a security patch addressing this inverted logic flaw and apply it immediately upon release.

Proactive Monitoring: Review application access logs for suspicious account modification or deletion activity initiated by non-administrative user accounts.

Compensating Controls: If a patch is unavailable, restrict access to the application to trusted networks via a VPN or implement strict Web Application Firewall (WAF) rules to filter requests targeting account management endpoints.

Public Exploit Available: Unknown.

Given the severe impact of unauthorized account manipulation, administrators must prioritize this issue. Organizations utilizing PolarLearn should audit existing user accounts for signs of tampering and prepare to deploy the vendor-supplied fix as soon as it becomes available to remediate this critical privilege escalation risk.