CVE-2026-116010

EUVD-2026-109268

24.10.2026, 12:16

RosarioSIS before 12.9.1 contains a missing authorization vulnerability that allows authenticated teachers to write records for students outside their course period by supplying arbitrary student IDs. Attackers can modify the st_arr, values, or attendance POST arrays in MakeReferral.php, EnterEligibility.php, InputFinalGrades.php, and TakeAttendance.php to create referrals, eligibility codes, attendance and final grades for any student in the school.

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	Primary	4.3 MEDIUM	NETWORK	LOW	LOW	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Awaiting analysis

This vulnerability is currently awaiting analysis.

Base Score

CVSS 3.x

EPSS Score

Percentile: Unknown

Common Weakness Enumeration

CWE-639 - Authorization Bypass Through User-Controlled Key
The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

References

https://gitlab.com/francoisjacquet/rosariosis/-/blob/v12.9/modules/Discipline/MakeReferral.php#L75

https://gitlab.com/francoisjacquet/rosariosis/-/commit/37b67dad841479799cc41bc969c7aea6626bab66

https://gitlab.com/francoisjacquet/rosariosis/-/issues/377

https://gitlab.com/francoisjacquet/rosariosis/-/releases/v12.9.1

https://www.vulncheck.com/advisories/rosariosis-before-12.9.1-missing-authorization-in-teacher-save-handlers