CVE-2026-116010: Authorization Bypass Through User-Controlled Key in francoisjacquet RosarioSIS
Affects francoisjacquet RosarioSISSource CVE Database V5
- Exploitation
Not in CISA KEV, no exploitation reported
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:NWhat to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| francoisjacquetRosarioSIS | Affected
| Fixed in
|
GitHub Actionsfrancoisjacquet/rosariosispkg:github/francoisjacquet/rosariosisOther threats | Affected
| Fixed in– |
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
AI-suggested
Upgrade RosarioSIS to version 12.9.1 or later, where this authorization bypass vulnerability has been fixed. No other mitigation or temporary workaround is indicated in the available data.
Description
RosarioSIS versions prior to 12.9.1 have an authorization bypass vulnerability that allows authenticated teachers to modify records for students outside their assigned course periods. By manipulating specific POST parameters in several PHP scripts, attackers can create or alter referrals, eligibility codes, attendance, and final grades for any student in the system.
Summary
CVE-2026-116010 describes a missing authorization check in RosarioSIS before version 12.9.1. Authenticated users with teacher privileges can supply arbitrary student IDs in POST requests to MakeReferral.php, EnterEligibility.php, InputFinalGrades.php, and TakeAttendance.php, enabling them to write or modify records for students not in their course period. This vulnerability allows unauthorized modification of student data such as referrals, eligibility codes, attendance, and final grades.
Impact
An attacker with valid teacher credentials can bypass authorization controls to alter sensitive student records outside their permitted scope. This can lead to unauthorized changes in academic and attendance data, potentially affecting student evaluations and school records integrity.
References
- gitlab.com/francoisjacquet/rosariosis/-/issues/377 (opens in a new tab)
- gitlab.com/francoisjacquet/rosariosis/-/commit/37b67dad841479799cc41bc969c7aea6626bab66 (opens in a new tab)
- gitlab.com/francoisjacquet/rosariosis/-/blob/v12.9/modules/Discipline/MakeReferral.php (opens in a new tab)
- gitlab.com/francoisjacquet/rosariosis/-/releases/v12.9.1 (opens in a new tab)
- vulncheck.com/advisories/rosariosis-before-12.9.1-missing-authorization-in-teacher-save-handlers (opens in a new tab)
Community reviews
Crowdsource mitigation strategies, share intel context, and vote on the most helpful responses.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.