Student-to-administrator escalation via missing endpoint authorization

Access control failure in Serosoft Academia SIS EagleR 1.0.118 allows remote authenticated users to create or modify administrator accounts. The /rest/staffResource/update and /create endpoints accept bearer tokens from student accounts without enforcing administrator roles before writing account data. A valid student account and network access are required; exploitation grants control over existing accounts or a newly created administrator account.