Vulnerability record/PUBLISHED/Published Nov 3, 2026 22:55:37 UTC
CVE-2026-121732
RosarioSIS before 12.9 contains an improper authorization vulnerability that allows school-scoped administrators to assign fees and payments to students of other schools via MassAssignFees.php and MassAssignPayments.php. Attackers can substitute foreign student IDs in the student[] POST array of a modfunc=save request to alter other schools' student billing balances, breaking school isolation.
Base score2.1/ 10
SeverityLowCVSS 4.0
Exploitability / impact
CVSS metric breakdown
Base severityLow
Attack vectorNetworkAV
Attack complexityLowAC
Attack requirementsPresentAT
Privileges requiredHighPR
User interactionNoneUI
Vulnerable system confidentialityNoneVC
Vulnerable system integrityLowVI
Vulnerable system availabilityNoneVA
Subsequent system confidentialityNoneSC
Subsequent system integrityNoneSI
Subsequent system availabilityNoneSA
CVSS vector string
CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:NCVSS communicates standardized severity and impact characteristics. It does not establish whether a system is exploitable in your specific environment.
Record context
CVE Numbering AuthorityVulnCheck
Last updatedNov 14, 2026 13:51:50 UTC
PublishedNov 3, 2026 22:55:37 UTC
ReservedNov 3, 2026 22:17:04 UTC
Credits
- harunmansor (NetbyteSEC)
- François Jacquet