Which versions of Gibbon are affected by CVE-2026-8207?

CVE-2026-8207 is a SQL injection vulnerability in Gibbon education platform versions before v30.0.01 that allows authenticated teachers to execute arbitrary database queries through the…. A patch is available.

Is there a public PoC exploit available for CVE-2026-8207?

Yes, a public proof-of-concept exploit is available for CVE-2026-8207. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-8207?

Within 24 hours: Identify all Gibbon installations and confirm versions; disable or restrict access to the Tracking/graphing module for all non-administrative teacher accounts pending remediation. Within 7 days: audit logs for suspicious SQL activity; review active teacher accounts and revoke unnecessary privileges; test upgrade path to v30.0.01 or later in a non-production environment. Within 30 days: deploy patched Gibbon version (v30.0.01 or later) to all production instances; restore module access only after patch verification and access controls are re-evaluated.

Gibbon CVE-2026-8207

Q: What is the CVSS score of CVE-2026-8207?

CVE-2026-8207 has a CVSS 4.0 base score of 7.0 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-28880 HIGH

SQL Injection (CWE-89)

2026-05-09 PRJBLK

GHSA-jhg5-9w7p-xm6m

PHP SQLi

7.0

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

7.0 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Patch available

May 09, 2026 - 04:31 EUVD

Source Code Evidence Fetched

May 09, 2026 - 03:30 vuln.today

Analysis Generated

May 09, 2026 - 03:30 vuln.today

CVSS changed

May 09, 2026 - 03:22 NVD

7.0 (HIGH)

CVE Published

May 09, 2026 - 02:41 nvd

HIGH 7.0

DescriptionCVE.org

Gibbon versions before v30.0.01 are affected by an authenticated SQL Injection vulnerability by abusing the Tracking/graphing https://github.com/GibbonEdu/core/blob/c431e25fdc874adece5d2dc7e408e9aa2d1abadb/modules/Tracking/graphing.php#L145 feature. Successful exploitation requires Teacher or higher privileges. Exploitation could result in unintended read/write activities to the underlying database.

AnalysisAI

SQL injection in Gibbon education platform versions prior to v30.0.01 enables authenticated users with Teacher privileges or higher to execute arbitrary SQL queries through the Tracking/graphing module. Exploitation allows unauthorized read and write access to the underlying database. Project Black Security Services has published detailed exploit documentation demonstrating the attack. While vendor release notes classify this as 'low severity, accessible to admin users only,' the CVSS 7.0 score and authenticated Teacher-level access requirement indicate moderate risk for multi-tenant or compromised-account scenarios.

Technical ContextAI

Gibbon is an open-source school management platform written in PHP. The vulnerability exists in the Tracking/graphing.php module at line 145, where user-supplied input is incorporated into SQL queries without proper sanitization or parameterized statements. This is a classic CWE-89 SQL injection flaw - the database interprets attacker-controlled data as executable SQL code rather than safe data. The affected component handles student tracking and data visualization features, requiring authenticated session state and Teacher role permissions enforced by Gibbon's role-based access control. The CPE identifier cpe:2.3:a:gibbonedu:gibbon confirms GibbonEdu's core product as the sole affected target, with all versions before v30.0.01 vulnerable.

RemediationAI

Upgrade to Gibbon v30.0.01 or later immediately. The patched release is available at https://github.com/GibbonEdu/core/releases/tag/v30.0.01 and directly addresses the SQL injection flaw in the Tracking/graphing module. Note that v30 minimum requirements are PHP 8.0 and MySQL 8.0, so infrastructure upgrades may be necessary before applying the patch. If immediate upgrade is not feasible, implement compensating controls: restrict access to the Tracking/graphing module by disabling it in module permissions for Teacher roles (retain access only for System Administrators who require the functionality), enable MySQL query logging to detect injection attempts, and implement web application firewall rules to block SQL metacharacters in Tracking module requests. These workarounds reduce attack surface but do not eliminate the vulnerability - upgrading remains the definitive fix. Review database access logs for suspicious queries executed by application database accounts between initial deployment and patch application to identify potential historical exploitation.