ECSoC_2026 & ELUSoC_2026 Fix: Race Condition Allows Multiple Exam Submissions

[Sairaj2033]

Bug Description

The submitExam controller does not verify if a student has already submitted an exam before saving a new Submission document.

Because there is no application-level check and no unique database constraint, a student can send concurrent POST requests to POST /api/submissions/:examId/submit and generate multiple graded submissions for the same exam, allowing them to manipulate their final score.

Location & Severity

• File: controllers/submissionController.js (Lines 4–36)
• Severity: High

[Sairaj2033]

@Sitaram8472 i would like to Fix this issue, I request You to Assign this Issue to me,
Contributor from ECSOC and ELUSOC both

[Zoya220]

Hi @Sitaram8472, I would love to work on this issue!

I can implement an application-level check in the submitExam controller to verify existing submissions before saving a new document, preventing the concurrent race condition described.

Please assign this issue to me under the ECSoC_2026 program tags. Thanks! 🚀