RosarioSIS CVE-2026-121732

Requires an authenticated administrator account that is school-scoped (the patch gates the new check on User('SCHOOLS') being set, i.e. an operator restricted to specific schools rather than a global admin) with access to the Student Billing module. The attacker must send a modfunc=save POST request to MassAssignFees.php or MassAssignPayments.php and place student IDs belonging to another school into the student[] POST array; pre-patch code iterated $_REQUEST['student'] directly without verifying each ID's SCHOOL_ID against the user's authorized schools. Limiting factors: the attacker must already hold a privileged school-admin session (PR:H), must know or guess valid foreign student IDs (integer IDs, likely enumerable), and impact is confined to writing/altering billing data - there is no read disclosure and no availability effect.

This is a low-severity, authorization-boundary flaw that is not an operational priority. The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:H/UI:N) and the vendor base score of 2.1 agree with the mechanism: exploitation requires an already-authenticated, school-scoped administrator (PR:H), and the only impact is low integrity (VI:L) - the ability to write fees/payments onto students belonging to other schools. There is no confidentiality or availability impact. The vuln.today decision label is 'monitor', consistent with a low-urgency, insider-boundary issue. No EPSS score is provided and the CVE is not listed in CISA KEV, so exploitation status is 'no public exploit identified at time of analysis'; the references are an upstream advisory, commit, and bug tracker issue, not working exploit code. The realistic risk is limited to a malicious or compromised school-level administrator corrupting billing data across the tenant boundary in a multi-school deployment - a data-integrity and trust problem, not a remote unauthenticated compromise. Note one metadata conflict to verify: the input tag 'Authentication Bypass' mischaracterizes this; CWE-639 and the description make clear it is improper authorization (IDOR) by an authenticated user, not an authentication bypass.

A legitimate but malicious (or compromised) administrator whose account is scoped to one school logs into RosarioSIS and opens the Mass Assign Fees or Mass Assign Payments screen. They submit a modfunc=save request but replace the student IDs in the student[] POST array with IDs belonging to a different school, causing fees or payment records to be written against students outside their authorized scope. No public exploit code is identified, though the trivial request-tampering technique is described in the upstream advisory and GitLab issue #376.