The vulnerability allows a logged‑in teacher to supply arbitrary student identifiers and alter referrals, eligibility codes, attendance, and final grades for any student in the school. By manipulating POST arrays in MakeReferral.php, EnterEligibility.php, InputFinalGrades.php, and TakeAttendance.php, the teacher can overwrite data that is normally restricted to students in their own course period. This represents a classic missing authorization flaw (CWE‑639) that compromises data integrity and may expose sensitive student information.

RosarioSIS versions prior to 12.9.1 are affected. The issue exists in the core module that handles teacher save operations, and any deployment running 12.8 or earlier will lack the required access checks.

The CVSS score of 5.3 indicates moderate severity. Exploitation requires a legitimate teacher login and the ability to submit POST requests to the exposed PHP scripts, so the attack vector is authenticated. EPSS data is not provided, and the vulnerability is not listed in the CISA KEV catalog, but the presence of an authorized role with broad write permissions elevates the practical risk.