CVE-2026-97879— zhistaredu StarTraining api-docs Endpoint SecurityConfig.java missing authentication
Quick assessment
Affected
zhistaredu StarTraining
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在 zhistaredu StarTraining 3.8.1 及更早版本中发现了一个安全漏洞。受影响的元素是 api-docs 组件中 SecurityConfig.java 文件的一个未知函数。该漏洞可能导致认证缺失，从而允许攻击者绕过身份验证机制。此漏洞可被远程利用，且相关利用代码已公开，可能被用于实施攻击。供应商在披露初期已被联系，但未作任何回应。
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-97879
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
zhistaredu StarTraining api-docs Endpoint SecurityConfig.java missing authentication
Source: CVE Program / CVE List V5
Vulnerability Description
A security flaw has been discovered in zhistaredu StarTraining up to 3.8.1. The affected element is an unknown function of the file SecurityConfig.java of the component api-docs Endpoint. Performing a manipulation results in missing authentication. It is possible to initiate the attack remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
关键功能的认证机制缺失
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| zhistaredu | StarTraining | 3.8.0 |
cpe:2.3:a:zhistaredu:startraining:*:*:*:*:*:*:*:*
|
|
II. Public POCs for CVE-2026-97879
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-97879
请登录查看更多情报信息。
Other References for CVE-2026-97879 (5)
-
https://vuldb.com/cve/CVE-2026-97879 third-party-advisory
-
-
https://vuldb.com/submit/913577 third-party-advisory
-
https://vuldb.com/vuln/409900 vdb-entry
Same Patch Batch · zhistaredu · 2026-09-25 · 3 CVEs total
| CVE-2026-97877 | 7.3 HIGH | zhistaredu StarTraining JWT Token application.yml UserLoginService.createToken hard-coded |
| CVE-2026-97878 | 7.3 HIGH | zhistaredu StarTraining Druid Console index.html anonymous missing authentication |
IV. Related Vulnerabilities
Same product: StarTraining
-
CVE-2026-100881
zhistaredu StarTraining application.yml cross site scripting -
CVE-2026-100880
zhistaredu StarTraining Upload Endpoint MimeTypeUtils.java c -
CVE-2026-100879
zhistaredu StarTraining dataScope Endpoint SysRoleServiceImp -
CVE-2026-100878
zhistaredu StarTraining authRole Endpoint SysUser.java SysUs -
CVE-2026-97878
zhistaredu StarTraining Druid Console index.html anonymous m
Same vendor: zhistaredu
-
CVE-2026-100881
zhistaredu StarTraining application.yml cross site scripting -
CVE-2026-100880
zhistaredu StarTraining Upload Endpoint MimeTypeUtils.java c -
CVE-2026-100879
zhistaredu StarTraining dataScope Endpoint SysRoleServiceImp -
CVE-2026-100878
zhistaredu StarTraining authRole Endpoint SysUser.java SysUs -
CVE-2026-97878
zhistaredu StarTraining Druid Console index.html anonymous m
Same weakness: CWE-306
-
CVE-2026-52748
Missing authentication for backup functionality in Kaon AR21 -
CVE-2026-82930
Missing Authentication in mH-DEVELOPER -
CVE-2026-82383
Apache Roller: Anonymous setup action allows frontpage confi -
CVE-2026-101004
notionnext-org NotionNext Authentication Guard cache.js clea -
CVE-2026-100903
ООО НПО Ритм GEOritm REST API obj-groups missing authenticat
V. Comments for CVE-2026-97879
No comments yet