Vulnerability Description
RosarioSIS before 12.9.1 contains a missing authorization vulnerability that allows authenticated teachers to write records for students outside their course period by supplying arbitrary student IDs. Attackers can modify the st_arr, values, or attendance POST arrays in MakeReferral.php, EnterEligibility.php, InputFinalGrades.php, and TakeAttendance.php to create referrals, eligibility codes, attendance and final grades for any student in the school.
CVSS Score
MEDIUM
Related Weaknesses (CWE)
References
- https://gitlab.com/francoisjacquet/rosariosis/-/blob/v12.9/modules/Discipline/Ma
- https://gitlab.com/francoisjacquet/rosariosis/-/commit/37b67dad841479799cc41bc96
- https://gitlab.com/francoisjacquet/rosariosis/-/issues/377
- https://gitlab.com/francoisjacquet/rosariosis/-/releases/v12.9.1
- https://www.vulncheck.com/advisories/rosariosis-before-12.9.1-missing-authorizat
- https://gitlab.com/francoisjacquet/rosariosis/-/work_items/377
FAQ
What is CVE-2026-116010?
CVE-2026-116010 is a vulnerability with a CVSS score of 4.3 (MEDIUM). RosarioSIS before 12.9.1 contains a missing authorization vulnerability that allows authenticated teachers to write records for students outside their course period by supplying arbitrary student IDs....
How severe is CVE-2026-116010?
CVE-2026-116010 has been rated MEDIUM with a CVSS base score of 4.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-116010?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.