Unifiedtransform Privilege Escalation Vulnerability Allowing Unauthorized Syllabus Creation

A privilege escalation vulnerability has been identified in Unifiedtransform version 2.X, allowing teachers to create syllabus entries. This functionality is intended solely for administrators. The issue arises from incorrect access control, which enables teachers to bypass authorization and add syllabus data, potentially disrupting academic management.

Impact

Exploitation of this vulnerability allows teachers to gain unauthorized access to syllabus creation features, leading to the addition of incorrect or misleading syllabus information.

Reproduction

To reproduce this vulnerability, log into the application as a teacher. Navigate to the syllabus creation endpoint, fill in the required fields, and save the entry. The syllabus will be created despite the lack of proper authorization.