A security vulnerability in yungifez Skuul School Management System versions up to 2.6.3 allows remote attackers to bypass authorization in the GraduationController::resetGraduation function. This issue is due to improper handling of the student argument in the Delete Handler component. The vulnerability has a medium severity with a CVSS score of 4.3 and can be mitigated by upgrading to version 3.0.0, which includes a patch identified by commit b42f2c80a8e5e01ca6e607bbd97f137ede368ac9.