RosarioSIS CVE-2026-19786

The victim must have an active authenticated session in RosarioSIS at the time of exploitation - unauthenticated users have no session cookies to abuse, so the attack yields no effect against them. The target instance must be running RosarioSIS 12.8 or earlier. The attacker must know or guess a valid modfunc parameter value that triggers a meaningful state change; however, since RosarioSIS is open source, action names are publicly enumerable from the source code. Exploitation is limited by the UI:P requirement: the victim must be induced to visit an attacker-controlled page or interact with attacker-injected content while authenticated. Deployments that enforce SameSite=Strict cookie policy, operate behind a VPN, or restrict network access to Modules.php are materially less exposed than publicly internet-facing instances with default cookie configuration.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N) scores 5.3 and correctly reflects the key limiting factor: user interaction is required (UI:P), meaning passive exploitation without a victim visiting a malicious page is not possible. The integrity impact is limited (VI:L) with no confidentiality or availability impact, constraining the blast radius even on successful exploitation. No EPSS score is included in the provided intelligence, so exploitation probability cannot be quantified from that signal. The vulnerability is not in CISA KEV and no POC has been identified, indicating no confirmed active exploitation. The real-world risk is moderate-low: the CSRF attack requires an authenticated victim session and deliberate user interaction, and the fix - though acknowledged as incomplete by the developer for same-origin scenarios - materially reduces the attack surface for the common cross-origin case. Organizations running RosarioSIS on versions up to 12.8 should prioritize patching during the next maintenance window rather than treating this as an emergency out-of-band response.

An attacker identifies a school running RosarioSIS 12.8 or earlier and crafts a webpage containing a hidden image or auto-submitting form that sends a request to the target's Modules.php with a chosen modfunc parameter value. When an authenticated administrator or teacher visits the malicious page - via a phishing email, a posted link, or injected content within the application - their browser automatically submits the request with their active session cookies, causing the module action to execute under their privileges. No public proof-of-concept code has been identified for this specific vulnerability.