Executive Summary

CVE-2025-10073 is a Broken Object Level Authorization (BOLA) vulnerability in Portabilis i-Educar up to version 2.10, specifically affecting the GET /module/Api/turma API endpoint. It allows any authenticated user, even those with low privileges, to bypass proper authorization checks and access sensitive academic class information by manipulating request parameters. This means unauthorized users can retrieve details about classes that they should not have access to. [1, 2]

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to unauthorized disclosure of internal academic information such as classes, courses, and schedules. Attackers can use it to gather detailed information about the institution's academic structure, which can be used for reconnaissance or combined with other vulnerabilities to target student records. Although it does not expose individual student data directly, it compromises the confidentiality of institutional metadata and may facilitate further attacks. [1, 2]

Useful 0 Not Useful 0

Compliance Impact

The unauthorized exposure of institutional metadata due to this vulnerability may violate data governance policies and compliance requirements. While it does not directly disclose personal student data, the leakage of sensitive academic information could still impact compliance with standards like GDPR or HIPAA by failing to adequately protect confidential institutional data. [1]

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by attempting to access the vulnerable endpoint `GET /module/Api/turma` as a non-privileged authenticated user and checking if unauthorized class information is returned. A suggested command using curl would be: curl -i -b cookie.txt 'https://<target>/module/Api/turma?oper=get&resource=turma&id=14' where 'cookie.txt' contains authentication cookies for a low-privilege user. If the response returns class data instead of a 403 Forbidden or no data, the system is vulnerable. [1]

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps are not documented in the provided resources. However, since the vulnerability is due to improper object-level authorization on the `/module/Api/turma` endpoint, it is recommended to restrict access to this API to authorized roles only (e.g., administrators, coordinators, teachers) and implement proper authorization checks. If a patch or update is available from the vendor, apply it promptly. Otherwise, consider restricting network access to the vulnerable endpoint or replacing the affected component with an alternative product. [2]

Useful 0 Not Useful 0