CVE-2026-116010

RosarioSIS before 12.9.1 Missing Authorization in Teacher Save Handlers

View on CVE.org
Published Oct 24, 2026 CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Description
RosarioSIS before 12.9.1 contains a missing authorization vulnerability that allows authenticated teachers to write records for students outside their course period by supplying arbitrary student IDs. Attackers can modify the st_arr, values, or attendance POST arrays in MakeReferral.php, EnterEligibility.php, InputFinalGrades.php, and TakeAttendance.php to create referrals, eligibility codes, attendance and final grades for any student in the school.

Analysis

AI-generated

Technical impact

The vulnerability allows a logged‑in teacher to supply arbitrary student identifiers and alter referrals, eligibility codes, attendance, and final grades for any student in the school. By manipulating POST arrays in MakeReferral.php, EnterEligibility.php, InputFinalGrades.php, and TakeAttendance.php, the teacher can overwrite data that is normally restricted to students in their own course period. This represents a classic missing authorization flaw (CWE‑639) that compromises data integrity and may expose sensitive student information.

Affected Systems

RosarioSIS versions prior to 12.9.1 are affected. The issue exists in the core module that handles teacher save operations, and any deployment running 12.8 or earlier will lack the required access checks.

Risk and Exploitability

The CVSS score of 5.3 indicates moderate severity. Exploitation requires a legitimate teacher login and the ability to submit POST requests to the exposed PHP scripts, so the attack vector is authenticated. EPSS data is not provided, and the vulnerability is not listed in the CISA KEV catalog, but the presence of an authorized role with broad write permissions elevates the practical risk.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update RosarioSIS to version 12.9.1 or later, which implements the necessary authorization checks.
  • If an immediate update is not feasible, enforce access controls that restrict teachers to modify only students in their own course period, and revise the PHP handlers to verify this relationship before persisting any data.
  • Implement audit logging for all student record updates and monitor for anomalies that match unauthorized student ID patterns.

Generated by OpenCVE AI on October 24, 2026 at 12:23 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
References
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
First Time appeared Francoisjacquet
Francoisjacquet rosariosis
Vendors & Products Francoisjacquet
Francoisjacquet rosariosis
Type Values Removed Values Added
Description RosarioSIS before 12.9.1 contains a missing authorization vulnerability that allows authenticated teachers to write records for students outside their course period by supplying arbitrary student IDs. Attackers can modify the st_arr, values, or attendance POST arrays in MakeReferral.php, EnterEligibility.php, InputFinalGrades.php, and TakeAttendance.php to create referrals, eligibility codes, attendance and final grades for any student in the school.
Title RosarioSIS before 12.9.1 Missing Authorization in Teacher Save Handlers
First Time appeared Rosariosis
Rosariosis rosariosis
Weaknesses CWE-639
CPEs cpe:2.3:a:rosariosis:rosariosis:*:*:*:*:*:*:*:*
Vendors & Products Rosariosis
Rosariosis rosariosis
References
Metrics cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N'}
Weaknesses
  • CWE-639

    Authorization Bypass Through User-Controlled Key

Sources

Status
PUBLISHED
Assigner
VulnCheck
Published
Updated
Oct 29, 2026, 2:46 PM
Reserved
Oct 24, 2026, 11:23 AM

View source JSON

Updated
Oct 29, 2026, 2:46 PM

JSON

Status
Deferred
Published
Oct 24, 2026, 12:16 PM
Modified
Oct 29, 2026, 3:17 PM

View source JSON

No data.

Updated
Oct 24, 2026, 3:15 PM

JSON