Skuul School Management System
Monthly
Missing authorization in yungifez Skuul School Management System up to and including 2.6.3 allows an authenticated user to reset the graduation status of a student record they are not entitled to act on by manipulating the 'student' argument passed to GraduationController::resetGraduation. The CVSS 4.0 score is 2.1 (independently assessed as CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N), reflecting the need for a valid session and an integrity-only impact - no data disclosure or outage - with practical exposure concentrated in multi-school deployments where user scope boundaries matter. A public PoC reference (a GitHub gist) exists but is not verified as working exploit code; there is no KEV listing and no confirmed active exploitation, and the priority decision is 'monitor'. The vendor fixed the issue in version 3.0.0.
Missing authorization in yungifez Skuul School Management System up to and including 2.6.3 allows an authenticated user to reset the graduation status of a student record they are not entitled to act on by manipulating the 'student' argument passed to GraduationController::resetGraduation. The CVSS 4.0 score is 2.1 (independently assessed as CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N), reflecting the need for a valid session and an integrity-only impact - no data disclosure or outage - with practical exposure concentrated in multi-school deployments where user scope boundaries matter. A public PoC reference (a GitHub gist) exists but is not verified as working exploit code; there is no KEV listing and no confirmed active exploitation, and the priority decision is 'monitor'. The vendor fixed the issue in version 3.0.0.