CVE-2025-56747

MEDIUM

Creativeitem Academy Lms < 5.13 - Improper Privilege Management

Title source: rule

Description

Creativeitem Academy LMS up to and including 5.13 contains a privilege escalation vulnerability in the Api_instructor controller where regular authenticated users can access instructor-only functions without proper role validation, allowing unauthorized course creation and management.

References (1)

[Exploit, Mitigation, Third Party Advisory] https://suryadina.com/academy-lms-instructor-escalation-3n7b9f2w5k

Scores

CVSS v3 6.5

EPSS 0.0006

EPSS Percentile 18.0%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

CISA SSVC

Vulnrichment

Exploitation poc

Automatable no

Technical Impact total

Details

CWE

CWE-269

Status published

Products (1)

creativeitem/academy_lms < 5.13

Published Oct 14, 2025

Tracked Since Feb 18, 2026