Low severity2.7NVD Advisory· Published Nov 3, 2026· Updated Nov 3, 2026
CVE-2026-121732
CVE-2026-121732
Description
RosarioSIS before 12.9 contains an improper authorization vulnerability that allows school-scoped administrators to assign fees and payments to students of other schools via MassAssignFees.php and MassAssignPayments.php. Attackers can substitute foreign student IDs in the student[] POST array of a modfunc=save request to alter other schools' student billing balances, breaking school isolation.
Affected products
1- Range: <12.9
Patches
Vulnerability mechanics
References
6- github.com/francoisjacquet/rosariosis/blob/v12.8.1/modules/Student_Billing/MassAssignFees.phpnvd
- github.com/francoisjacquet/rosariosis/blob/v12.8.1/modules/Student_Billing/MassAssignPayments.phpnvd
- github.com/francoisjacquet/rosariosis/commit/a8bb460aacb11661934e6e91fbe0d8158fbc0c4fnvd
- github.com/francoisjacquet/rosariosis/releases/tag/v12.9nvd
- gitlab.com/francoisjacquet/rosariosis/-/issues/376nvd
- www.vulncheck.com/advisories/rosariosis-before-12.9-improper-authorization-via-student-billing-mass-assignmentnvd
News mentions
0No linked articles in our index yet.