This vulnerability involves an insecure direct object reference (IDOR) in Mojoomla School Management software versions <= 93.1.0. An unauthenticated attacker can bypass authorization controls by manipulating user-controlled keys, leading to unauthorized access to certain data. The CVSS 3.1 vector indicates the attack requires no privileges or user interaction and impacts confidentiality with low severity, without affecting integrity or availability. No known exploits are reported in the wild, and no vendor-provided patch or official remediation level is documented.

The impact is limited to a confidentiality loss due to unauthorized access to data through insecure direct object references. There is no impact on integrity or availability. Since the vulnerability is exploitable without authentication, it poses a risk of data exposure to unauthenticated attackers. However, the overall severity is medium, reflecting the limited scope of impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, organizations should consider restricting access to the affected application, monitoring for unusual access patterns, and applying compensating controls to limit exposure. No vendor advisory or patch links are currently available.