Threats affecting pkg:github/yungifez/skuul

CVE-2026-124502 is a medium severity vulnerability in yungifez Skuul School Management System versions 2.6.0 through 2.6.3. It involves missing authorization in the GraduationController::resetGraduation function, allowing remote attackers to manipulate the student argument without proper authorization. The issue is fixed in version 3.0.0.

Skuul School Management System versions up to 2.6.5 contain an access control vulnerability in the ResultChecker::checkResult method. Authenticated students can manipulate the studentId parameter to access other students' examination results without authorization.