A vulnerability was found in francoisjacquet RosarioSIS up to 12.8. (CVE-2026-19786)
A cross-site request forgery (CSRF) vulnerability exists in francoisjacquet RosarioSIS up to version 12.8 due to improper processing of the Modules.php file. This vulnerability allows remote attackers to perform unauthorized actions via manipulated requests. The issue is addressed by upgrading to version 12.9, which includes a patch identified by commit 801a71272c82cf4bf695fdc5ed42a9b7511d124d.
AI Analysis
Technical Summary
RosarioSIS versions up to 12.8 contain a CSRF vulnerability (CWE-352) related to the handling of the Modules.php file. An attacker can exploit this vulnerability remotely by tricking a user into submitting a crafted request that performs unauthorized actions. The vulnerability has a CVSS 3.1 base score of 4.3 (medium severity), indicating low complexity and no privileges required but requiring user interaction. The issue is fixed in version 12.9 by applying the patch identified by commit 801a71272c82cf4bf695fdc5ed42a9b7511d124d.
Potential Impact
Successful exploitation allows an attacker to induce a user to perform unintended actions on the RosarioSIS application without their consent. The vulnerability does not impact confidentiality or availability but can lead to integrity loss through unauthorized modifications. Remote exploitation is possible without prior authentication, but user interaction is required.
Mitigation Recommendations
Upgrade RosarioSIS to version 12.9 or later, which contains the official fix for this CSRF vulnerability. Applying the patch identified by commit 801a71272c82cf4bf695fdc5ed42a9b7511d124d will remediate the issue. No other mitigations are specified or required once the upgrade is applied.
A vulnerability was found in francoisjacquet RosarioSIS up to 12.8. (CVE-2026-19786)
Description
A cross-site request forgery (CSRF) vulnerability exists in francoisjacquet RosarioSIS up to version 12.8 due to improper processing of the Modules.php file. This vulnerability allows remote attackers to perform unauthorized actions via manipulated requests. The issue is addressed by upgrading to version 12.9, which includes a patch identified by commit 801a71272c82cf4bf695fdc5ed42a9b7511d124d.
CVSS v3.1
Score 4.3medium
Affected software
pkg:github/francoisjacquet/rosariosisRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
RosarioSIS versions up to 12.8 contain a CSRF vulnerability (CWE-352) related to the handling of the Modules.php file. An attacker can exploit this vulnerability remotely by tricking a user into submitting a crafted request that performs unauthorized actions. The vulnerability has a CVSS 3.1 base score of 4.3 (medium severity), indicating low complexity and no privileges required but requiring user interaction. The issue is fixed in version 12.9 by applying the patch identified by commit 801a71272c82cf4bf695fdc5ed42a9b7511d124d.
Potential Impact
Successful exploitation allows an attacker to induce a user to perform unintended actions on the RosarioSIS application without their consent. The vulnerability does not impact confidentiality or availability but can lead to integrity loss through unauthorized modifications. Remote exploitation is possible without prior authentication, but user interaction is required.
Mitigation Recommendations
Upgrade RosarioSIS to version 12.9 or later, which contains the official fix for this CSRF vulnerability. Applying the patch identified by commit 801a71272c82cf4bf695fdc5ed42a9b7511d124d will remediate the issue. No other mitigations are specified or required once the upgrade is applied.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-3g87-x9p3-8gc7
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-19786"]
- Ecosystems
- []
- Database Specific Severity
- MODERATE
- Cvss Version
- 3.1
Threat ID: 6a7f446cbf8831d53964c5c7
Added to database: 08/14/2026, 16:38:04 UTC
Last enriched: 08/14/2026, 18:39:31 UTC
Last updated: 08/14/2026, 18:41:00 UTC
Views: 3
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.