CVE-2026-121732
2.7 LOWpublic exploit availablePublished 2026-11-03 · Updated 2026-11-03
AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.
NVD description
RosarioSIS before 12.9 contains an improper authorization vulnerability that allows school-scoped administrators to assign fees and payments to students of other schools via MassAssignFees.php and MassAssignPayments.php. Attackers can substitute foreign student IDs in the student[] POST array of a modfunc=save request to alter other schools' student billing balances, breaking school isolation.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N
Weaknesses
CWE-639
Public exploit & PoC references
- https://github.com/francoisjacquet/rosariosis
- https://github.com/francoisjacquet/rosariosis/blob/v12.8.1/modules/Student_Billing/MassAssignFees.php#L15
- https://github.com/francoisjacquet/rosariosis/blob/v12.8.1/modules/Student_Billing/MassAssignPayments.php#L16
- https://github.com/francoisjacquet/rosariosis/commit/a8bb460aacb11661934e6e91fbe0d8158fbc0c4f
- https://github.com/francoisjacquet/rosariosis/releases/tag/v12.9
All references
- https://github.com/francoisjacquet/rosariosis
- https://github.com/francoisjacquet/rosariosis/blob/v12.8.1/modules/Student_Billing/MassAssignFees.php#L15
- https://github.com/francoisjacquet/rosariosis/blob/v12.8.1/modules/Student_Billing/MassAssignPayments.php#L16
- https://github.com/francoisjacquet/rosariosis/commit/a8bb460aacb11661934e6e91fbe0d8158fbc0c4f
- https://github.com/francoisjacquet/rosariosis/releases/tag/v12.9
- https://gitlab.com/francoisjacquet/rosariosis/-/issues/376
- https://www.vulncheck.com/advisories/rosariosis-before-12.9-improper-authorization-via-student-billing-mass-assignment
Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.
Related CVEs
- CRITICALCVE-2024-34323
- MEDIUMCVE-2025-71420PoC
- MEDIUMCVE-2026-100142
- UNSCOREDCVE-2026-100177PoC
- HIGHCVE-2026-100268
- MEDIUMCVE-2026-100272
- HIGHCVE-2026-100514
- HIGHCVE-2026-100517
Related by shared AI tags and CWE weakness class. Browse the full archive.