LOW 2.1 NVD
CVE-2026-121732
RosarioSIS before 12.9 contains an improper authorization vulnerability that allows school-scoped administrators to assign fees and payments to students of othe
RosarioSIS before 12.9 contains an improper authorization vulnerability that allows school-scoped administrators to assign fees and payments to students of other schools via MassAssignFees.php and MassAssignPayments.php. Attackers can substitute foreign student IDs in the student[] POST array of a modfunc=save request to alter other schools' student billing balances, breaking school isolation.
References
- https://github.com/francoisjacquet/rosariosis
- https://github.com/francoisjacquet/rosariosis/blob/v12.8.1/modules/Student_Billing/MassAss
- https://github.com/francoisjacquet/rosariosis/blob/v12.8.1/modules/Student_Billing/MassAss
- https://github.com/francoisjacquet/rosariosis/commit/a8bb460aacb11661934e6e91fbe0d8158fbc0
- https://github.com/francoisjacquet/rosariosis/releases/tag/v12.9
This low severity vulnerability with a CVSS score of 2.1 was published on 2026-11-03 via NVD.
vulnfeed aggregates 18613 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.