CVE-2026-90851: phpgurukul hostel_management_system Incorrect Privilege Assignment

Vulnerability summary

CVE-2026-90851 is a medium (CVSS 6.5) Incorrect Privilege Assignment vulnerability in phpgurukul hostel_management_system. EPSS estimates a 0.37% chance of exploitation in the next 30 days, higher than 29% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 15-09-2026
   PublishedVulnerability first disclosed.
2. 15-09-2026
   Last modifiedVulnerability information updated.

Description

A flaw has been found in PHPGurukul Hostel Management System 3.0. This affects an unknown part of the file /admin/includes/checklogin.php. This manipulation of the argument ID causes improper access controls. Remote exploitation of the attack is possible. The exploit has been published and may be used.

• CWE-266Incorrect Privilege AssignmentA product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor.
• CWE-284Improper Access ControlThe product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.