CVE-2026-116010
Deferred Deferred - Pending Action

RosarioSIS Missing Authorization Allows Teacher Record Manipulation

Publication date: 2026-10-24

Last updated on: 2026-10-24

Assigner: VulnCheck

Description
RosarioSIS before 12.9.1 contains a missing authorization vulnerability that allows authenticated teachers to write records for students outside their course period by supplying arbitrary student IDs. Attackers can modify the st_arr, values, or attendance POST arrays in MakeReferral.php, EnterEligibility.php, InputFinalGrades.php, and TakeAttendance.php to create referrals, eligibility codes, attendance and final grades for any student in the school.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-24
Last Modified
2026-10-24
Generated
2026-10-24
AI Q&A
2026-10-24
EPSS Evaluated
N/A
NVD
CVE-2026-116010
EUVD
EUVD-2026-109268

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
francoisjacquet RosarioSIS 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

RosarioSIS before version 12.9.1 has a missing authorization vulnerability (CVE-2026-116010) that allows authenticated teachers to manipulate student records outside their assigned course periods. By supplying arbitrary student IDs, teachers can modify data in specific PHP files to create referrals, eligibility codes, attendance records, and final grades for any student in the school.

Detection Guidance

To detect this vulnerability, inspect network traffic for POST requests to RosarioSIS PHP files like MakeReferral.php, EnterEligibility.php, InputFinalGrades.php, and TakeAttendance.php. Look for requests containing st_arr, values, or attendance arrays with arbitrary student IDs not enrolled in the teacher's course period. Check server logs for unauthorized modifications to student records outside assigned courses.

Impact Analysis

This vulnerability allows unauthorized teachers to alter student records such as grades, attendance, and disciplinary actions for students not in their classes. It could lead to incorrect academic records, unfair disciplinary actions, or eligibility code manipulations affecting students' academic standing.

Compliance Impact

This vulnerability could lead to non-compliance with data integrity and access control requirements in GDPR and HIPAA. Unauthorized record changes may violate data accuracy principles, and lack of proper authorization checks may breach access control and audit requirements.

Mitigation Strategies

Immediately upgrade RosarioSIS to version 12.9.1 or later. Ensure server-side validation is implemented in affected modules to verify student IDs against enrollment records before processing requests. Review and restrict database permissions for teachers to prevent unauthorized modifications.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-116010. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart