Portabilis i‑Educar versions up to 2.10 contain an unknown function in FinalStatusImportService.php that allows manipulation of the school_id argument, resulting in improper authorization. This flaw enables a remote attacker to access or modify data belonging to other schools. The vulnerability can be exploited over the network, and a publicly available proof‑of‑concept has been released, demonstrating how an attacker could impersonate other institutions and potentially obtain sensitive information.

All installations of Portabilis i‑Educar up to and including version 2.10 are affected. The vulnerability resides in the Final Status Import component and impacts any instance where external users can invoke the service with a crafted school_id.

The CVSS score of 5.3 indicates a medium severity, but the EPSS probability of less than 1% suggests that active exploitation is unlikely at present. The vulnerability is not listed in the CISA KEV catalog, implying no confirmed widespread attacks yet. An attacker can exploit the defect by sending a crafted request to the FinalStatusImportService endpoint, altering the school_id parameter, and achieving unauthorized data access. Because the flaw is remote and carries a public proof‑of‑concept, it should be treated as a moderate threat pending a vendor fix.