CVE-2026-121732
lowRosarioSIS before 12.9 contains an improper authorization vulnerability that allows school-scoped administrators to assign fees and payments to students of oth…
RosarioSIS before 12.9 contains an improper authorization vulnerability that allows school-scoped administrators to assign fees and payments to students of other schools via MassAssignFees.php and MassAssignPayments.php. Attackers can substitute foreign student IDs in the student[] POST array of a modfunc=save request to alter other schools' student billing balances, breaking school isolation.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N Affected products
Not reported by the source (unknown — not "none").
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
No vendor advisory or patch reference tagged by NVD. Check the references below.
References
- https://github.com/francoisjacquet/rosariosis disclosure@vulncheck.com
- https://github.com/francoisjacquet/rosariosis/blob/v12.8.1/modules/Student_Billing/MassAss... disclosure@vulncheck.com
- https://github.com/francoisjacquet/rosariosis/blob/v12.8.1/modules/Student_Billing/MassAss... disclosure@vulncheck.com
- https://github.com/francoisjacquet/rosariosis/commit/a8bb460aacb11661934e6e91fbe0d8158fbc0... disclosure@vulncheck.com
- https://github.com/francoisjacquet/rosariosis/releases/tag/v12.9 disclosure@vulncheck.com
- https://gitlab.com/francoisjacquet/rosariosis/-/issues/376 disclosure@vulncheck.com
- https://www.vulncheck.com/advisories/rosariosis-before-12.9-improper-authorization-via-stu... disclosure@vulncheck.com