TI-2026-80079 Aliases CVE-2026-116010 GHSA-vm5w-pxvw-x49v

Missing authorization in RosarioSIS teacher save handlers

MEDIUM 57CWE-639Published 2026-10-24 · Updated 2026-10-29

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Attack requirements: None
Impact type: Security bypass
Confidentiality · integrity · availability: None · Low · None
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-639.

Summary

RosarioSIS before 12.9.1 lets authenticated teachers write records for students outside their course period. The flaw is a missing authorization check that trusts user-supplied student IDs in POST arrays, so an authenticated teacher with low privileges can create referrals, eligibility codes, attendance and final grades for any student in the school. The weakness is classified as CWE-639.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

RosarioSIS before 12.9.1 contains a missing authorization vulnerability that allows authenticated teachers to write records for students outside their course period by supplying arbitrary student IDs. Attackers can modify the st_arr, values, or attendance POST arrays in MakeReferral.php, EnterEligibility.php, InputFinalGrades.php, and TakeAttendance.php to create referrals, eligibility codes, attendance and final grades for any student in the school.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00204 10th percentileScored 2026-11-07

Fix Fixed RosarioSIS (francoisjacquet): 12.9.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
francoisjacquet	RosarioSIS	before 12.9.1	12.9.1	Patch available	CNA

RosarioSIS Vendorfrancoisjacquet Affected before 12.9.1 Fixed in 12.9.1 Patch available CNA

Remediation

Upgrade RosarioSIS to version 12.9.1 or later, which fixes the issue.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Fix · CNA RosarioSIS (francoisjacquet) Fixed in 12.9.1

Timeline

2026-10-24 Threatist record created from CVE-2026-116010
2026-10-24 Alias added: GHSA-vm5w-pxvw-x49v
2026-10-29 CISA SSVC decision points changed
2026-10-29 Priority changed: LOW → MEDIUM

References

Patch 1

https://gitlab.com/francoisjacquet/rosariosis/-/commit/37b67dad841479799cc41bc969c7aea6626bab66

Other 3

TI-2021-20041 An unauthenticated SQL Injection vulnerability in Rosario Student Information System (aka… CVSS 3.1CRITICAL 9.8
TI-2023-00941 Exposure of Sensitive Information to an Unauthorized Actor in francoisjacquet/rosariosis CVSS 3.1HIGH 7.5
TI-2026-62651 RosarioSIS before 12.9 Path Traversal in File Deletion via filename Parameter CVSS 4.0HIGH 7.1
TI-2021-20153 An unauthenticated SQL Injection vulnerability exists in RosarioSIS before 7.6.1 via the… CVSS 3.1CRITICAL 9.8
TI-2023-14071 RosarioSIS 10.8.4 is vulnerable to CSV injection via the Periods Module. CVSS 3.1MEDIUM 5.4
TI-2026-16048 francoisjacquet RosarioSIS Modules.php cross-site request forgery CVSS 4.0MEDIUM 5.3

See all 27 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences