EUVD-2026-113992
GHSA-w3xr-5cfx-cw4p
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as a valid student
-
ExploitAccess the checkResult results endpoint
-
ExecutionTamper with the studentId parameter
-
ImpactRetrieve another student's examination marks
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Object-level authorization, IDOR prevention
|
| Exploitation Conditions | Requires a valid authenticated student account on the Skuul School Management System (version ≤ 2.6.5); with that account, the attacker invokes the ResultChecker::checkResult result-checking feature and alters the user-controlled studentId parameter to an arbitrary target. Limiting factors: exploitation is gated on holding legitimate student credentials (PR:L), so it is not fully unauthenticated; however, no victim interaction (UI:N) and no special or non-default configuration are needed - the flawed authorization check is in the standard results feature. Impact is bounded to reading other students' examination results/marks (confidentiality only). |
| Impact | This is a moderate, authorization-level data-exposure flaw (CWE-639, IDOR) rather than a top-priority emergency. The input CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N (6.5) is internally consistent with the description: network-reachable web endpoint, low complexity, and a low-privilege authenticated student account required (PR:L), with impact limited to confidentiality (C:H) and no integrity or availability effect. The exploitation signals argue AGAINST urgency: EPSS is only 0.16% (5th percentile), there is no CISA KEV listing (not actively exploited per available data), and the vuln.today Decision label is 'this_month' - a routine patch cadence, not act_now/emergency. The one escalating signal is a public PoC reference (dollarboysushil write-up), which lowers the barrier to opportunistic abuse by anyone with a student login. The C:H rating is arguably generous - the exposed data is scoped to other students' examination marks rather than full-system confidentiality - so the real-world severity may sit slightly below 6.5. Net: a genuine privacy/authorization bug worth remediating on a normal cycle, not a drop-everything issue. |
| Exploit ScenarioDerived | A logged-in student browsing the results-checking feature intercepts or edits the request to ResultChecker::checkResult and substitutes a different studentId value, causing the application to return another student's examination marks without any authorization check. A public PoC reference exists (it is not verified as working exploit code), so the technique is documented and trivially repeatable by any authenticated student. No victim interaction, elevated privileges, or special tooling beyond a browser or proxy is required. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Nov 03, 2026
Skuul School Management System through version 2.6.5 lets any holder of a valid student account read other students' examination results and marks, because the ResultChecker::checkResult method accepts a client-supplied studentId without confirming that the requested record belongs to the caller. The flaw is CWE-639 (authorization bypass through a user-controlled key), reachable over the network by a low-privileged authenticated user with no victim interaction, and scored CVSS 6.5 with confidentiality-only impact. Exploitation is gated on legitimate student credentials; no public exploit code is confirmed at time of analysis, EPSS is 0.16% (5th percentile), and the issue is not in CISA KEV, making this a moderate data-exposure risk rather than an emergency.
RemediationAI
No vendor-released patch or fixed version is identified at time of analysis: neither the CVE references (the project repository github.com/yungifez/skuul and the write-up github.com/dollarboysushil/cve) nor the EUVD record names a patched release, so the exact fix version cannot be cited and must be confirmed with the maintainer before relying on an upgrade. Updating is the only complete fix; until a patched build is available, the actionable compensation is code-level rather than configuration-level - modify ResultChecker::checkResult so the studentId is discarded and the identity is always derived from the authenticated session, or add an explicit ownership check that the requested result record belongs to the calling student before returning data. The trade-off is that custom edits to vendor code must be re-applied after every upstream update and can conflict with later releases. Where modification is not possible, restrict the result-checker endpoint to known networks or roles and log every access with the supplied studentId so cross-student lookups are detectable; both measures reduce exposure but leave the underlying authorization gap open and will break legitimate self-service result viewing for students outside the allowlisted scope. Reviewing existing database and web logs for a single account requesting a wide range of studentId values will indicate whether the flaw has already been used, given that exploitation produces no write operations and leaves only access-log evidence.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-639, Authorization Bypass Through User-Controlled Key, the classic insecure-direct-object-reference pattern in which an application authorizes the action but not the object. In Skuul, the ResultChecker::checkResult method (the class/method notation indicates a PHP-style implementation) takes a studentId value from the request and uses it to look up examination results, but does not re-derive the identity from the authenticated session or verify that the record being fetched belongs to the logged-in student. Any authenticated student can therefore substitute an arbitrary studentId and receive another student's examination marks. The CVSS vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N confirms the attack surface: network-reachable, no special conditions or attacker-controlled timing dependencies stated in the available sources, requires a legitimate low-privileged account, requires no victim interaction, and is scoped to the vulnerable component with high confidentiality impact and no integrity or availability effect. The published CPE data (cpe:2.3:a:n/a:n/a) and the EUVD affected-version list do not resolve to a concrete vendor/product/version tuple, so version scoping rests on the reported 'through 2.6.5' range rather than on authoritative CPE matching.
Know when N A gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Network web endpoint abusable by any low-privilege student (PR:L, AC:L, UI:N); impact is unauthorized read of others' results, so C:H with I:N/A:N.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
2DescriptionCVE.org
Skuul School Management System through version 2.6.5 is vulnerable to incorrect access control in the ResultChecker::checkResult method. An authenticated student can manipulate the studentId parameter to retrieve another student's examination results, including examination marks, without authorization.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutContr
Reachable assertion in Open5GS up to version 2.7.6 allows remote unauthenticated attackers to crash the Diameter CER han
A Command Injection issue in the payload build page in BYOB (Build Your Own Botnet) 2.0 allows attackers to execute arbi
Denial of service in Open5GS 2.7.6 and earlier allows network-adjacent attackers with low-privilege Diameter Gx peer acc
Denial of service in Open5GS HSS (Home Subscriber Server) versions 2.7.0 through 2.7.6 is triggered remotely by manipula
Remote command injection in Control Web Panel allows unauthenticated attackers to execute arbitrary OS commands as root
LINQPad before 5.52.01 Pro edition is vulnerable to Unsafe Deserialization in LINQPad.AutoRefManager::PopulateFromCache(
Remote code execution in dash-uploader (Python package for Plotly Dash) versions 0.1.0 through 0.7.0a2 allows unauthenti
Command injection in LiteLLM 1.18.10 lets attackers who can configure MCP (Model Context Protocol) servers supply arbitr
SQL injection in AzuraCast's backup restore flow (versions up to and including 0.23.7) lets an attacker achieve privileg
Arbitrary file read in Yu AI Code Mother v4.3 lets anonymous, remote attackers retrieve files outside the intended previ
Remote code execution in APScheduler (all versions through 3.10.x and 4.0.0a5) is achievable when applications deseriali
Exploit-DB