Improper Authorization in RosarioSIS Allows Cross-School Fee Assignments

CVE-2026-121732

What is CVE-2026-121732?

RosarioSIS prior to version 12.9 has a significant vulnerability that allows school administrators to improperly access and assign billing-related fees and payments to students from different schools. This vulnerability exploits flaws in the MassAssignFees.php and MassAssignPayments.php functionalities, permitting attackers to alter student billing balances by submitting foreign student IDs through the student[] POST array in a modfunc=save request. This not only jeopardizes data integrity but also compromises the separation between different school instances, enabling unauthorized access to sensitive financial information.

References