Vulnerability · Published Oct 24, 2026 · Assigned by VulnCheck

CVE-2026-116010RosarioSIS before 12.9.1 Missing Authorization in Teacher Save Handlers

Medium 4.3

In plain English

A medium-severity authorization bypass via user-controlled key in RosarioSIS from francoisjacquet. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 10% of all known vulnerabilities).

Severity (CVSS 3.1)4.3Medium

Exploit odds (30 days)0.2%top 89.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

RosarioSIS before 12.9.1 contains a missing authorization vulnerability that allows authenticated teachers to write records for students outside their course period by supplying arbitrary student IDs. Attackers can modify the st_arr, values, or attendance POST arrays in MakeReferral.php, EnterEligibility.php, InputFinalGrades.php, and TakeAttendance.php to create referrals, eligibility codes, attendance and final grades for any student in the school.

Affected products (as reported)

Vendor	Product	Versions
francoisjacquet	RosarioSIS	0 – before 12.9.1

Weakness: CWE-639 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

References

https://gitlab.com/francoisjacquet/rosariosis/-/issues/377 issue-tracking
https://gitlab.com/francoisjacquet/rosariosis/-/commit/37b67dad841479799cc41bc969c7aea6626bab66 patch
https://gitlab.com/francoisjacquet/rosariosis/-/blob/v12.9/modules/Discipline/MakeReferral.php#L75 technical-description
https://gitlab.com/francoisjacquet/rosariosis/-/releases/v12.9.1 release-notes
VulnCheck Advisory: RosarioSIS before 12.9.1 Missing Authorization in Teacher Save Handlers third-party-advisory
https://gitlab.com/francoisjacquet/rosariosis/-/work_items/377 exploit