Portabilis i‑Educar exposes a weakness in FinalStatusImportService.php where manipulating the school_id argument can bypass authorization checks. The flaw, classified as improper authorization, permits a remote attacker to access or modify data belonging to other schools. The attack can be carried out over the network and has a publicly available exploit, escalating the risk of confidential data leakage or integrity compromise.

All installations of Portabilis i‑Educar up to and including version 2.10 are affected. The vulnerability resides in the Final Status Import component and impacts any instance where external users can invoke the service with a crafted school_id.

The CVSS score of 5.3 indicates a medium severity, but the EPSS probability of less than 1% suggests that active exploitation is unlikely at present. The vulnerability is not listed in the CISA KEV catalog, implying no confirmed widespread attacks yet. An attacker can exploit the defect by sending a crafted request to the FinalStatusImportService endpoint, altering the school_id parameter, and achieving unauthorized data access. Because the flaw is remote and carries a public proof‑of‑concept, it should be treated as a moderate threat pending a vendor fix.