The Zyosoft School App contains an authorization bypass vulnerability classified as CWE-639 (Authorization Bypass Through User-Controlled Key). Authenticated attackers can exploit this flaw by modifying a specific parameter to gain unauthorized read and write access to other users' data. The vulnerability has a CVSS 4.0 base score of 8.6, indicating high severity with network attack vector, low attack complexity, no privileges required beyond authentication, and no user interaction needed. The vulnerability is publicly disclosed but lacks an official fix or patch at this time.

Successful exploitation allows an authenticated attacker to bypass authorization controls and access or modify data belonging to other users within the Zyosoft School App. This can lead to unauthorized disclosure and alteration of sensitive user information, potentially impacting user privacy and data integrity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is provided, users should monitor Zyosoft communications for updates. Until a patch is available, restrict access to the application to trusted users and consider additional access control measures to limit the impact of this vulnerability.