CVE-2026-121732 Details
Description
RosarioSIS before 12.9 contains an improper authorization vulnerability that allows school-scoped administrators to assign fees and payments to students of other schools via MassAssignFees.php and MassAssignPayments.php. Attackers can substitute foreign student IDs in the student[] POST array of a modfunc=save request to alter other schools' student billing balances, breaking school isolation.
An improper authorization vulnerability has been identified in RosarioSIS versions prior to 12.9. This vulnerability allows school-scoped administrators to assign fees and payments to students from other schools, bypassing school isolation. The issue arises in the 'MassAssignFees.php' and 'MassAssignPayments.php' modules, where the application fails to properly validate student IDs before processing fee and payment assignments. As a result, administrators can manipulate the student[] POST array to alter billing balances for students in different schools.
Users are advised to upgrade to RosarioSIS version 12.9 or later, where this vulnerability has been addressed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Nov 3, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/francoisjacquet/rosariosis | [email protected] | ProductSource CodeVendor |
| https://github.com/francoisjacquet/rosariosis/blob/v12.8.1/modules/Student_Billing/MassAssignFees.php#L15 | [email protected] | Source CodeVendor |
| https://github.com/francoisjacquet/rosariosis/blob/v12.8.1/modules/Student_Billing/MassAssignPayments.php#L16 | [email protected] | Source CodeVendor |
| https://github.com/francoisjacquet/rosariosis/commit/a8bb460aacb11661934e6e91fbe0d8158fbc0c4f | [email protected] | Source CodeVendor |
| https://github.com/francoisjacquet/rosariosis/releases/tag/v12.9 | [email protected] | Release NotesVendor |
| https://gitlab.com/francoisjacquet/rosariosis/-/issues/376 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
| https://www.vulncheck.com/advisories/rosariosis-before-12.9-improper-authorization-via-student-billing-mass-assignment | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-639 | Authorization Bypass Through User-Controlled Key | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| RosarioSIS | >= 0, < 12.9 |
CPE
Remediation
| |
Change History
1 change record found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 3, 2026 | New CVE Received | [email protected] |