CVE-2026-24900
📋 TL;DR
MarkUs versions before 2.9.1 contain an authorization bypass vulnerability where users can access arbitrary student submission files by manipulating the select_file_id parameter. This allows unauthorized viewing of other students' submitted work. All users of affected MarkUs instances are potentially impacted.
💻 Affected Systems
- MarkUs
📦 What is this software?
Markus by Markusproject
⚠️ Risk & Real-World Impact
Worst Case
Malicious users could systematically download all student submissions, compromising academic integrity and exposing sensitive student work across courses.
Likely Case
Students accessing other students' submissions to copy work or gain unfair advantages on assignments.
If Mitigated
Limited exposure if proper access controls and monitoring are in place, but still violates privacy expectations.
🎯 Exploit Status
Exploitation requires authenticated access but is trivial - simply modifying the select_file_id parameter in requests to the vulnerable endpoint.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.9.1
Vendor Advisory: https://github.com/MarkUsProject/Markus/security/advisories/GHSA-56gh-8hmq-7q88
Restart Required: Yes
Instructions:
1. Backup your current MarkUs installation and database. 2. Update to MarkUs version 2.9.1 or later. 3. Restart the MarkUs application server. 4. Verify the fix by testing the vulnerable endpoint.
🔧 Temporary Workarounds
Disable vulnerable endpoint
allTemporarily disable or restrict access to the /courses/*/assignments/*/submissions/html_content endpoint
# Configure web server (e.g., nginx/apache) to block or restrict the endpoint
# Example nginx: location ~* /courses/.*/assignments/.*/submissions/html_content { deny all; }
🧯 If You Can't Patch
- Implement strict access controls and monitoring for the vulnerable endpoint
- Deploy a web application firewall (WAF) with rules to detect parameter manipulation attempts
🔍 How to Verify
Check if Vulnerable:
Test if authenticated users can access submission files belonging to other users by modifying the select_file_id parameter in requests to the vulnerable endpoint.Check Version:
Check the MarkUs version in the application interface or configuration files, or run: grep -r 'MARKUS_VERSION' /path/to/markus/installation/Verify Fix Applied:
After updating to 2.9.1, verify that attempts to access other users' submission files via parameter manipulation are properly rejected with authorization errors.📡 Detection & Monitoring
Log Indicators:
- Multiple failed authorization attempts on submission endpoints
- Unusual access patterns to submission files from single users
- Requests with manipulated select_file_id parameters
Network Indicators:
- HTTP requests to /courses/*/assignments/*/submissions/html_content with unusual select_file_id values
- Rapid sequential requests to submission endpoints
SIEM Query:
source="web_server_logs" AND uri_path="/courses/*/assignments/*/submissions/html_content" AND (status_code=200 OR status_code=403) | stats count by src_ip, uri_path