RosarioSIS CVE-2026-116010

Requires a valid authenticated teacher account in RosarioSIS (PR:L); it is not exploitable by anonymous/remote-unauthenticated attackers. The concrete trigger is manipulating the st_arr, values, or attendance POST arrays submitted to the save handlers MakeReferral.php, EnterEligibility.php, InputFinalGrades.php, and TakeAttendance.php so they carry student IDs outside the teacher's own course period; the server performs no ownership/authorization check on those IDs. Limiting factors: the attacker must already hold teacher-level credentials, and impact is confined to writing/forging records (referrals, eligibility codes, attendance, final grades) for students in the same school - there is no read/exfiltration or availability impact. Affects all versions before 12.9.1 regardless of configuration (no special deployment mode is cited as required).

This is a medium-severity authorization flaw (CVSS 4.0 base 5.3, CWE-639 missing authorization / IDOR) whose real-world risk is moderate and insider-bounded rather than an urgent emergency. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) confirms network reach, low complexity, no user interaction, and - critically - PR:L, meaning a valid authenticated account (a teacher) is required; this is therefore an authenticated privilege/authorization issue, not a pre-auth compromise. Impact is narrow: VI:L with VC:N/VA:N, i.e. limited integrity impact (writing/forging student records) and no confidentiality or availability loss. No EPSS score and no KEV listing were provided, and the input contains no PoC or exploit-code reference, so exploitation signals are weak: no public exploit identified at time of analysis and no evidence of active exploitation. The vuln.today decision label is 'this_month' (not act_now/emergency), consistent with a patch-on-normal-cadence posture. The main risk driver is that the trusted teacher population is large and the flaw lets any one of them tamper with records (referrals, eligibility, attendance, final grades) for any student in the school - an integrity and data-trust problem (e.g. grade/attendance fraud) rather than a system-takeover problem. No conflicting signals were observed between the description and the CVSS vector; both agree on authenticated, limited-integrity impact.

A legitimately authenticated teacher opens one of the affected save handlers (e.g. TakeAttendance.php or InputFinalGrades.php) and, instead of submitting data only for students in their own course period, tampers with the st_arr/values/attendance POST arrays to include arbitrary student IDs. Because the handler never verifies the student belongs to the teacher's roster, the server writes forged referrals, eligibility codes, attendance, or final grades for any student in the school. No public exploit code is identified in the input; abuse requires only a standard web proxy or browser dev tools to alter the POST parameters.