openSIS Classic CVE-2026-91107

Requires an authenticated session holding the built-in teacher role (PR:L); no admin rights, user interaction, or non-default configuration is needed. The specific prerequisite is access to the School Information update path (modules/users/includes/SchoolsInfoInc.php via Staff.php), where the user-controlled staff_id request parameter is not validated against the logged-in user's own user_id, so the operator can select an arbitrary staff record and cause its password to be reset. The limiting factor is that the attacker must first possess valid teacher-level credentials to the openSIS Classic instance; exploitation is otherwise straightforward over the network against default installations.

This is a genuine high-priority issue, not a CVSS-inflated one. The input CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N, 9.3 Critical) is well-supported by the description and the vendor patch: a low-privileged but authenticated teacher account can reset any staff account's password via an unvalidated staff_id, which is a classic CWE-639 IDOR enabling privilege escalation to administrator and effective account takeover. The patch commit directly corroborates the flaw - it adds an ownership check tying the selected staff_id to the session user's own user_id and a 403 for non-admins editing other records - so the vulnerability and fix are confirmed from source code, not merely asserted. Tempering the risk: no EPSS score, no CISA KEV listing, and no public POC are provided, so there is no evidence of active or automated exploitation; realistic risk is bounded by the fact that an attacker must first hold a valid teacher-level account. Note a minor labeling tension: the Tags list 'Authentication Bypass,' but the CWE and behavior describe an authorization/IDOR flaw that results in account takeover - the practical effect (resetting another user's credentials) overlaps with authentication compromise but the root cause is broken authorization. Verify the exact affected version range with the vendor, as CPE lists all versions ('*') while the title cites 9.3 specifically.

A malicious or compromised teacher logs into openSIS Classic and, using the School Information update feature, substitutes the staff_id parameter with the identifier of an administrator account. The vulnerable update path accepts the attacker-controlled staff_id without verifying ownership and resets that admin account's password, letting the teacher take over a privileged account and gain full administrative control of the student information system. No public exploit code is identified at time of analysis, but the flaw is simple and reliably triggered via normal web requests.