CVE-2026-35610

CVE-2026-35610 is a privilege escalation vulnerability in PolarLearn, a free and open-source learning platform, affecting version 0-PRERELEASE-14 and earlier. The flaw exists in the account-management module where an inverted admin check in the setCustomPassword() and deleteUser() functions allows authenticated non-admin users to execute privileged actions while blocking legitimate administrators from doing so. The vulnerability carries a CVSS 3.1 score of 8.8 (HIGH) due to its network accessibility, low attack complexity, and requirement only for basic user authentication. The attack has high impact across confidentiality, integrity, and availability, as compromised accounts could be modified or deleted by unprivileged users. The FAUCET Risk Score of 42.0/100 indicates moderate overall risk in the threat landscape. There is currently no evidence of active exploitation in the wild, as the vulnerability is not listed in CISA's Known Exploited Vulnerabilities (KEV) catalog and remains inactive on vulnerability hotlists. The EPSS score of 0.00046 suggests low probability of exploitation within the next 30 days. However, given the straightforward nature of the logic error and the open-source nature of the software, organizations using PolarLearn should prioritize patching once updates are available.