The Central Board of Secondary Education (CBSE) confirmed that security vulnerabilities existed within its On-Screen Marking evaluation portal [1, 2].
This admission follows reports that critical flaws in the digital system could have allowed the alteration of Class 12 examination marks. Because these results determine university admissions and career paths for millions of students, any compromise in the integrity of the evaluation process poses a significant risk to the national education system.
The board thanked the ethical hackers who reported the gaps and invited further vulnerability reports to improve the portal's resilience [1, 2]. The vulnerabilities were brought to light by a 19-year-old researcher [4], whose findings prompted the board to shift from initial denials to an admission of the flaws [2].
To address potential inaccuracies resulting from these system issues, the CBSE opened a review window for Class 12 answer sheets on May 19, 2024 [3, 5]. This window allows students to seek corrections for possible errors in the evaluation process [3].
Officials said the board is now collaborating with cybersecurity experts to secure the Onmark portal. The effort aims to protect the integrity of student results, and prevent future unauthorized access to the marking system [1, 2].
While some reports focused on general evaluation errors, other findings specifically highlighted security vulnerabilities that could be exploited by external actors [2, 3]. The board said it is prioritizing the resolution of these flaws to ensure the stability of the digital marking infrastructure [1].
“The Central Board of Secondary Education (CBSE) confirmed that security vulnerabilities existed within its On-Screen Marking evaluation portal.”
The incident highlights the precarious transition of large-scale public institutions to digital-first evaluation systems. By pivoting from denial to an open invitation for ethical hackers, the CBSE is attempting to adopt a 'bug bounty' mentality to secure its infrastructure, though the initial vulnerability suggests a gap in the board's internal security auditing before the system went live.
