CVE-2026-19784
Received Received - Intake

Authorization Bypass in RosarioSIS Student Information System

Publication date: 2026-08-14

Last updated on: 2026-08-14

Assigner: VulDB

Description
A flaw has been found in francoisjacquet RosarioSIS up to 12.8. This affects the function DBUpdate of the file Discipline/Referrals.php. This manipulation causes authorization bypass. The attack may be initiated remotely. The exploit has been published and may be used. Upgrading to version 12.9 is able to mitigate this issue. Patch name: 04dd1a368ddf80ad7082baefa3c656e4e1825c76. It is suggested to upgrade the affected component.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-14
Last Modified
2026-08-14
Generated
2026-08-14
AI Q&A
2026-08-14
EPSS Evaluated
N/A
NVD
CVE-2026-19784
EUVD
EUVD-2026-58568

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
francoisjacquet rosariosis to 12.8 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-285 The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an Insecure Direct Object Reference (IDOR) flaw in RosarioSIS up to version 12.8. It allows authenticated users with edit permissions to bypass authorization checks and modify or delete records outside their intended scope by manipulating record IDs. The issue affects multiple modules including Discipline Referrals, Student Billing, and Gradebook Assignments.

Detection Guidance

To detect this IDOR vulnerability in RosarioSIS, inspect HTTP requests for save or delete operations in the Discipline Referrals, Student Billing, or Gradebook Assignments modules. Check if requests lack proper scoping parameters like school ID, year, or student ID. Compare with view operations that correctly scope data by role. Look for unauthorized modifications or deletions by manipulating record IDs.

Impact Analysis

An attacker could exploit this to alter or delete sensitive school records such as student grades, billing information, or disciplinary referrals without proper authorization. This could lead to incorrect academic records, financial discrepancies, or reputational damage to the institution.

Compliance Impact

This vulnerability could lead to unauthorized access or modification of sensitive student or financial data, violating privacy and data integrity requirements under regulations like GDPR and FERPA. It may result in non-compliance with data protection principles and require breach notifications.

Mitigation Strategies

Upgrade RosarioSIS to version 12.9 or later to apply the security patch that mitigates the authorization bypass vulnerability. Ensure the patch 04dd1a368ddf80ad7082baefa3c656e4e1825c76 is applied to enforce scope verification in save and delete operations.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-19784. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart