The Zyosoft School App contains a CWE-639 vulnerability, specifically an authorization bypass through a user-controlled key. This insecure direct object reference flaw permits authenticated remote attackers to modify a parameter to read and alter data belonging to other users. The CVSS 4.0 base score is 8.6, indicating a high impact with network attack vector, low attack complexity, no privileges required beyond authentication, and no user interaction needed. The vulnerability affects version 0 of the app and was published on May 2, 2026. No vendor remediation or patch information is available, and the product is not a cloud service.

Exploitation of this vulnerability allows an authenticated attacker to bypass authorization controls and access or modify data of other users within the Zyosoft School App. This could lead to unauthorized disclosure and modification of sensitive user information. The high CVSS score reflects the significant risk posed by this vulnerability in terms of confidentiality and integrity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level has been provided by Zyosoft, organizations should monitor vendor communications for updates. In the meantime, restrict access to the application to trusted users and consider additional application-layer controls to detect or prevent unauthorized parameter manipulation.