A vertical privilege escalation vulnerability in the XueZhiSi Open Source Exam System permits lower-privileged teacher accounts to delete administrator accounts, posing a severe risk to system integrity.

The vulnerability exists in the teacher-end interface at POST /api/teacher/user/delete/{id}. The application fails to perform necessary authorization checks, allowing an authenticated teacher to perform administrative actions, specifically deleting accounts with higher privilege levels.

Successful exploitation of this flaw allows an attacker to delete administrative accounts, leading to a complete loss of administrative control over the examination platform. Given the CVSS score of 8.1, this represents a high-severity risk that could result in unauthorized system disruption and potential data loss, as the integrity of the user management system is compromised.

Immediate Action: Since a specific patch version is not currently identified, administrators should restrict access to the teacher-end API endpoints via network segmentation or authentication proxy rules.

Proactive Monitoring: Audit application logs for suspicious POST requests to the /api/teacher/user/delete/ endpoint, specifically filtering for teacher-role accounts attempting to delete accounts with higher role identifiers.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to block or inspect traffic directed at the identified vulnerable API path to prevent unauthorized deletion requests from reaching the backend.

Public Exploit Available: Unknown.

This vulnerability requires immediate attention due to the high severity of potential privilege escalation. Organizations using the XueZhiSi Open Source Exam System must prioritize restricting access to the affected API endpoints and monitor user deletion logs until a vendor-supplied update is verified and deployed.