EUVD-2026-119759
GHSA-q4wc-r234-m6wv
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as low-privilege Skuul user
-
ExploitSend crafted resetGraduation POST with target student
-
ExecutionAuthorization/scope check fails to block
-
ImpactStudent graduation record reset
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires an authenticated session on a Skuul instance (CVSS PR:L) and the ability to reach the GraduationController::resetGraduation route of the Delete/reset handler; the attacker manipulates the 'student' argument to act on a student record. Limiting factors: no anonymous access (valid credentials needed), impact is confined to resetting graduation status (integrity-only, VI:L, no data disclosure or outage), and the affected product is the niche yungifez Skuul application up to and including 2.6.3. The source evidence indicates the real precondition is cross-scope access - a user acting on a student outside their intended school scope - so single-tenant deployments where users only ever see their own scope face reduced practical exposure. The complete fix is upgrading to v3.0.0 (the vendor states the affected component should be upgraded). |
| Impact | All signals point to a genuinely low-priority issue. The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) scores only 2.1, driven by VI:L as the sole impact (no confidentiality, no availability, no scope change). PR:L means exploitation requires an authenticated account, not an anonymous attacker. No EPSS score is provided, KEV status is not present (not actively exploited), and the vuln.today Decision label is 'monitor' - the lowest urgency tier. A PoC is referenced but, per the input, it is 'reference only, not verified as working exploit code,' so this is a public PoC reference that is not confirmed working, distinct from active exploitation. The only tension worth flagging: the record is labeled 'missing authorization' (CWE-862), yet the source-code evidence shows the pre-patch resetGraduation() already contained an authorize('resetGraduation', ...) call, and the fix's BUGS.md frames the real defect as rows not being constrained to the table's own school scope. This suggests the weakness is insufficient multi-tenant scoping rather than a wholesale absence of an authorization check - verify the precise policy behavior with the vendor PR. Net: a real but minor authorization-integrity bug in a niche application, not a severity emergency. |
| Exploit ScenarioDerived | An authenticated low-privilege user of a Skuul tenant sends a crafted POST to the resetGraduation route supplying a student identifier they should not be able to act on, causing that student's graduation record to be reset. A public PoC reference exists (a GitHub gist) but is not verified as working exploit code, and the impact is limited to integrity (VI:L) of graduation data with no confidentiality or availability effect. Exploitation is remote (AV:N) and requires low privileges (PR:L). |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Nov 09, 2026
Missing authorization in yungifez Skuul School Management System up to and including 2.6.3 allows an authenticated user to reset the graduation status of a student record they are not entitled to act on by manipulating the 'student' argument passed to GraduationController::resetGraduation. The CVSS 4.0 score is 2.1 (independently assessed as CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N), reflecting the need for a valid session and an integrity-only impact - no data disclosure or outage - with practical exposure concentrated in multi-school deployments where user scope boundaries matter. A public PoC reference (a GitHub gist) exists but is not verified as working exploit code; there is no KEV listing and no confirmed active exploitation, and the priority decision is 'monitor'. The vendor fixed the issue in version 3.0.0.
RemediationAI
Upgrade to Skuul v3.0.0, the release that addresses this issue (https://github.com/yungifez/skuul/releases/tag/v3.0.0); the vendor states the affected component should be upgraded. The fix is carried by commit b42f2c80a8e5e01ca6e607bbd97f137ede368ac9 and PR https://github.com/yungifez/skuul/pull/433, which delete the GraduationController::resetGraduation action and move the graduation and promotion table operations into Livewire methods that look up rows with the table's own school scope, and which also remove unused write routes (fee, fee-category, timetable store/update, the whole TimetableTimeSlotController) and five unused form requests. No interim workaround is documented in the available references, and VulDB advisory https://vuldb.com/vuln/432807 plus the CTI page https://vuldb.com/vuln/432807/cti are the tracking entries; the priority decision is 'monitor', with a public PoC reference (https://gist.github.com/mrvirus2006/94d6e1ed1d6cd9ddf6412c734a76243d) present but not verified as working exploit code.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Skuul is a PHP application built on the Laravel framework, and the affected code is the GraduationController action in app/Http/Controllers/GraduationController.php that resets a student's graduation status, taking the target student as an argument. The flaw is classified as CWE-862 (Missing Authorization): the action did not adequately ensure the caller was permitted to act on that specific student, so manipulating the 'student' argument allowed an authenticated user to reach records outside their intended school scope. The pre-patch source shows the method did call a resetGraduation authorization gate after a role check, so the available sources do not spell out the precise mechanism by which argument manipulation defeats the scoping check - the trigger is not fully described in the supplied evidence. The upstream fix (commit b42f2c80a8e5e01ca6e607bbd97f137ede368ac9, PR #433, release v3.0.0) removes the resetGraduation controller method entirely and moves the people, promotion and graduation table actions into Livewire methods that resolve rows using the table's own school scope; the same patch deletes unused write routes (fee, fee-category, timetable store/update and the whole TimetableTimeSlotController) and five unused form requests, which the vendor describes as open surface no screen covered. Deployment context matters: multi-tenant or multi-school instances where users are scoped to one school carry the real cross-scope risk, while single-tenant deployments where users only ever see their own scope face reduced practical exposure.
Know when Skuul School Management System gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P
Remote and low-complexity but requires an authenticated low-privilege account (PR:L); impact is integrity-only (reset of graduation data) with no confidentiality or availability effect.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A security vulnerability has been detected in yungifez Skuul School Management System up to 2.6.3. Affected by this vulnerability is the function GraduationController::resetGraduation of the file app/Http/Controllers/GraduationController.php of the component Delete Handler. Such manipulation of the argument student leads to missing authorization. The attack can be executed remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 3.0.0 addresses this issue. The name of the patch is b42f2c80a8e5e01ca6e607bbd97f137ede368ac9. The affected component should be upgraded.
Threat Intelligence Overview
NVD
CVE.org
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB