The CVSS 5.4 assigned to CVE-2026-78115 materially understates the actual risk. The vulnerability — an IDOR in /admin/edit_user_account.php enabling unauthorized modification of admin accounts — represents a direct privilege-escalation path that the CVSS base metric's single-user scope assumptions don't capture. In a timetabling system, compromising an admin account doesn't just mean changing a username parameter; it means access to student records, faculty data, scheduling infrastructure, and often integration with institutional SSO or email systems. That's a trust-chain foothold, not a standalone account compromise.
What makes this worse: the SourceCodester ecosystem exhibits a well-documented pattern where authorization flaws persist across releases and CVEs without generating patches. The 'educational/demo software' framing has created a protective mythology — the assumption that these systems exist in hermetically sealed deployment contexts — but the reality is that small institutions with limited security oversight deploy them in production precisely because they're free, pre-configured, and easy to install. Once deployed, there's no maintenance incentive and no update monitoring, meaning the population of unpatched instances compounds over time rather than shrinks.
For defenders: treat this as a privilege-escalation finding with data-breach downstream impact, not a low-severity parameter-manipulation issue. Inventory any SourceCodester timetabling deployments in your environment — including abandoned or 'temporary' instances that may have migrated to production. The remediation path requires source-code review since no vendor patch will arrive; look for role-verification logic around account-modification endpoints and implement explicit authorization checks. Given the historical pattern, assume similar IDOR flaws exist in adjacent admin functions unless proven otherwise.