CVE-2026-19786
Received Received - Intake

Cross-Site Request Forgery in RosarioSIS

Publication date: 2026-08-14

Last updated on: 2026-08-14

Assigner: VulDB

Description
A vulnerability was found in francoisjacquet RosarioSIS up to 12.8. This issue affects some unknown processing of the file Modules.php. Performing a manipulation results in cross-site request forgery. Remote exploitation of the attack is possible. Upgrading to version 12.9 is capable of addressing this issue. The patch is named 801a71272c82cf4bf695fdc5ed42a9b7511d124d. It is recommended to upgrade the affected component.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-14
Last Modified
2026-08-14
Generated
2026-08-14
AI Q&A
2026-08-14
EPSS Evaluated
N/A
NVD
CVE-2026-19786
EUVD
EUVD-2026-58571

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
francoisjacquet rosariosis to 12.8 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-352 The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a Cross-Site Request Forgery (CSRF) issue in RosarioSIS software versions up to 12.8. It allows attackers to perform unauthorized actions by manipulating requests to the Modules.php file. The flaw arises from improper handling of the modfunc parameter, enabling remote exploitation without user interaction.

Detection Guidance

This vulnerability is specific to RosarioSIS versions before 12.9 and involves a CSRF issue in Modules.php. Detection requires checking the software version and examining the Modules.php file for the presence of the modfunc parameter handling. No direct network commands are provided in the context.

Impact Analysis

An attacker could trick authenticated users into executing unwanted actions, such as modifying settings or data, without their knowledge. This could lead to unauthorized changes in the system, data corruption, or potential privilege escalation depending on the actions performed.

Compliance Impact

This vulnerability involves a cross-site request forgery (CSRF) issue in RosarioSIS, allowing unauthorized actions via manipulated requests. While not directly impacting GDPR or HIPAA, CSRF vulnerabilities can lead to unauthorized data modifications or deletions, potentially violating integrity and access control requirements under these regulations. Organizations handling sensitive student or health data must ensure such vulnerabilities are patched to maintain compliance.

Mitigation Strategies

Upgrade RosarioSIS to version 12.9 or later to address the vulnerability. The patch 801a71272c82cf4bf695fdc5ed42a9b7511d124d removes the modfunc parameter from links and sanitizes user input to prevent CSRF attacks.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-19786. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart