EUVD-2026-58568
GHSA-9q5c-5jw2-5hfp
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate with low-privilege account
-
DeliveryIdentify target module endpoint (Discipline, Accounting, Attendance)
-
ExploitEnumerate or guess numeric record ID from another school
-
ExecutionSubmit crafted HTTP request with foreign record ID
-
PersistDatabase query executes without SCHOOL_ID validation
-
ImpactUnauthorized record modified or deleted
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Object-level authorization, IDOR prevention
|
| Exploitation Conditions | Exploitation requires an authenticated user account on the RosarioSIS instance - the CVSS 4.0 vector confirms PR:L (low-privilege authentication). The vulnerability is most impactful in multi-school (multi-tenant) deployments where multiple schools share a single RosarioSIS installation, because the IDOR allows crossing school-context boundaries. In single-school deployments, the attacker is still confined to that school's own records, reducing practical impact further. The attacker must also be able to enumerate or guess valid numeric record IDs belonging to another school. No special configuration, non-default features, or elevated roles are required beyond holding any valid login. User interaction is not required (UI:N). There is no confidentiality exposure - the attack is limited to unauthorized modification or deletion of data (VI:L). |
| Impact | Real-world risk is low-to-moderate despite the availability of a public exploit. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) confirms network-reachable exploitation requiring only low-privilege authentication, with no attack complexity - any authenticated school user can attempt it. However, impact metrics (VC:N/VI:L/VA:N/SC:N/SI:N/SA:N) confirm the blast radius is limited to low-integrity writes within the application; there is no confidentiality or availability impact. The EPSS score is not provided in the input data, so exploitation probability cannot be quantified. KEV status is absent, meaning CISA has not confirmed active exploitation. The public exploit is a GitHub issue demonstrating the IDOR, not a weaponized standalone tool. In practice, exploitation requires the attacker to already hold a valid account on a multi-school RosarioSIS installation and to know or enumerate numeric record IDs belonging to a different school - limiting realistic impact to insider threat or compromised-account scenarios. This is not a critical fire-drill, but schools running multi-tenant deployments should treat it as a concrete integrity risk and upgrade promptly. |
| Exploit ScenarioDerived | An authenticated low-privilege user (e.g., a teacher or staff member at School A in a multi-school RosarioSIS instance) crafts HTTP requests to the Discipline, Accounting, or Attendance module endpoints, substituting the numeric record ID in the request parameter with an ID belonging to School B. Because the pre-patch queries filter only on ID and not on SCHOOL_ID, the server modifies or deletes School B's record without authorization. A public proof-of-concept demonstrating this technique exists in GitHub issue #301. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 14, 2026
Authorization bypass via Insecure Direct Object Reference (IDOR) in RosarioSIS up to version 12.8 allows authenticated low-privilege users to manipulate numeric record IDs in HTTP requests to save or delete records belonging to other schools within the same multi-tenant installation. The vulnerability is program-wide, affecting at least Accounting, Attendance, and Discipline modules - not limited to Discipline/Referrals.php as the CVE description implies. A publicly available exploit exists (GitHub issue #301); the flaw is not in CISA KEV and CVSS 4.0 scores it at 2.1 with an active proof-of-concept modifier.
RemediationAI
Upgrade to RosarioSIS version 12.9, which includes commit 04dd1a368ddf80ad7082baefa3c656e4e1825c76 applying SCHOOL_ID and SYEAR constraints to all affected database queries. The release is available at https://github.com/francoisjacquet/rosariosis/releases/tag/v12.9; upgrade via git pull and checkout of the v12.9 tag, or by overwriting files, as documented in the release notes. Note that v12.9 includes breaking changes requiring updated companion add-ons: Reports module 12.1+, NFC/QR Actions module 2.6+, and Parent Agreement plugin 10.5+. If immediate upgrade is not possible, a compensating control is to restrict RosarioSIS to single-school deployments (eliminating cross-school IDOR risk) or to enforce network-level access controls so only trusted, role-appropriate users can reach the application - both measures reduce but do not eliminate risk from insider threats.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
RosarioSIS (CPE: cpe:2.3:a:francoisjacquet:rosariosis:*:*:*:*:*:*:*:*) is a PHP-based open-source Student Information System for K-12 schools. The root cause is CWE-639: Authorization Bypass Through User-Controlled Key (IDOR). Database update and delete queries across multiple modules accepted a user-supplied numeric ID (e.g., WHERE ID='<int>') without verifying that the referenced record's SCHOOL_ID or SYEAR matched the authenticated user's own school context. The fix, committed as 04dd1a368ddf80ad7082baefa3c656e4e1825c76, adds AND SCHOOL_ID='UserSchool()' AND SYEAR='UserSyear()' constraints to affected queries across Accounting/Categories.php, Accounting/Expenses.php, Accounting/Incomes.php, Accounting/Salaries.php, Accounting/StaffPayments.php, Attendance/AttendanceCodes.php, Discipline/DisciplineForm.php, and Discipline/Referrals.php. This is a multi-tenant isolation failure, not merely a single-function flaw.
Know when Rosariosis gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P
Network-reachable web app requires low-privilege auth (PR:L); only low integrity impact (I:L) via unauthorized record modification; no confidentiality or availability impact confirmed.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A flaw has been found in francoisjacquet RosarioSIS up to 12.8. This affects the function DBUpdate of the file Discipline/Referrals.php. This manipulation causes authorization bypass. The attack may be initiated remotely. The exploit has been published and may be used. Upgrading to version 12.9 is able to mitigate this issue. Patch name: 04dd1a368ddf80ad7082baefa3c656e4e1825c76. It is suggested to upgrade the affected component.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Related Vulnerabilities in RosarioSIS Authorization and Injection Flaws
View all 3More in Rosariosis
View allAn unauthenticated SQL Injection vulnerability in Rosario Student Information System (aka rosariosis) before 8.1.1 allow
SQL Injection in GitHub repository francoisjacquet/rosariosis prior to 9.0. Rated critical severity (CVSS 9.1), this vul
Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository francoisjacquet/rosariosis prior to 10.8
Reflected Cross-site scripting (XSS) vulnerability in RosarioSIS 8.2.1 allows attackers to inject arbitrary HTML via the
Reflected Cross-Site Scripting vulnerability in Modules.php in RosarioSIS Student Information System < 6.5.1 allows remo
RosarioSIS 6.7.2 is vulnerable to XSS, caused by improper validation of user-supplied input by the PrintSchedules.php sc
RosarioSIS 6.7.2 is vulnerable to XSS, caused by improper validation of user-supplied input by the Preferences.php scrip
Improper Handling of Length Parameter Inconsistency in GitHub repository francoisjacquet/rosariosis prior to 10.0. Rated
RosarioSIS 10.8.4 is vulnerable to CSV injection via the Periods Module. Rated medium severity (CVSS 5.4), this vulnerab
Cross-site Scripting (XSS) - Stored in GitHub repository francoisjacquet/rosariosis prior to 8.9.3. Rated medium severit
Cross-site Scripting (XSS) - Stored in GitHub repository francoisjacquet/rosariosis prior to 9.0.1. Rated medium severit
Cross-site Scripting (XSS) - Stored in GitHub repository francoisjacquet/rosariosis prior to 9.0. Rated medium severity
Exploit-DB