Medium severity4.3NVD Advisory· Published Oct 24, 2026· Updated Oct 24, 2026
CVE-2026-116010
CVE-2026-116010
Description
RosarioSIS before 12.9.1 contains a missing authorization vulnerability that allows authenticated teachers to write records for students outside their course period by supplying arbitrary student IDs. Attackers can modify the st_arr, values, or attendance POST arrays in MakeReferral.php, EnterEligibility.php, InputFinalGrades.php, and TakeAttendance.php to create referrals, eligibility codes, attendance and final grades for any student in the school.
Affected products
1- Range: <12.9.1
Patches
Vulnerability mechanics
References
5- gitlab.com/francoisjacquet/rosariosis/-/blob/v12.9/modules/Discipline/MakeReferral.phpnvd
- gitlab.com/francoisjacquet/rosariosis/-/commit/37b67dad841479799cc41bc969c7aea6626bab66nvd
- gitlab.com/francoisjacquet/rosariosis/-/issues/377nvd
- gitlab.com/francoisjacquet/rosariosis/-/releases/v12.9.1nvd
- www.vulncheck.com/advisories/rosariosis-before-12.9.1-missing-authorization-in-teacher-save-handlersnvd
News mentions
0No linked articles in our index yet.