A security vulnerability has been detected in SourceCodester College Notes Gallery Management System 1.0. This impacts an unknown function of the file signup.php of the component Registration Flow. Such manipulation of the argument role leads to improper privilege management. The attack can be launched remotely. The exploit has been disclosed publicly and may be used.

A security vulnerability has been identified in SourceCodester College Notes Gallery Management System 1.0. The flaw resides in the signup.php file within the Registration Flow component. Attackers can manipulate the 'role' argument to achieve improper privilege management, effectively allowing unauthorized privilege escalation. The attack can be executed remotely without requiring physical access. A public exploit has already been disclosed and may be actively leveraged by threat actors. The vulnerability is tracked as CVE-2026-90856 and has been reported via VulDB and GitHub. This affects web-based educational content management systems running the vulnerable version. Organizations using this software should apply patches or mitigations immediately.