Missing Authorization in RosarioSIS for Teacher Actions

CVE-2026-116010

What is CVE-2026-116010?

RosarioSIS versions prior to 12.9.1 are susceptible to a missing authorization flaw that allows authenticated teachers to alter records for students not enrolled in their courses. By providing arbitrary student IDs, teachers can manipulate critical data points such as referrals, eligibility codes, attendance records, and final grades through key PHP files like MakeReferral.php, EnterEligibility.php, InputFinalGrades.php, and TakeAttendance.php. This vulnerability exposes the system to unauthorized data manipulation, potentially undermining the integrity of the school's record-keeping.

References