RosarioSIS billing flaw lets admins alter other schools' balances
Key facts
- Attack vector
- Network
- Privileges required
- High
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- Present
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- None · Low · None
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-639.
Summary
RosarioSIS before 12.9 contains an improper authorization flaw in its student billing mass assignment pages, MassAssignFees.php and MassAssignPayments.php. A school-scoped administrator can substitute student IDs from other schools in the student[] POST array, which lets them change other schools' student billing balances and breaks school isolation (CWE-639). Exploitation requires high privileges on the network and affects integrity only, with a CVSS 4.0 base score of 2.1.
Written with Claude Haiku 5.5 from the sources below · 2026-11-04
Description from the CNA
RosarioSIS before 12.9 contains an improper authorization vulnerability that allows school-scoped administrators to assign fees and payments to students of other schools via MassAssignFees.php and MassAssignPayments.php. Attackers can substitute foreign student IDs in the student[] POST array of a modfunc=save request to alter other schools' student billing balances, breaking school isolation.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| francoisjacquet | RosarioSIS | before 12.9 | 12.9 | Patch available | CNA |
- RosarioSIS Vendorfrancoisjacquet Affected before 12.9 Fixed in 12.9 Patch available CNA
Remediation
Upgrade RosarioSIS to version 12.9 or later, which fixes the flaw.
Written with Claude Haiku 5.5 from the sources below · 2026-11-04
- Fix · CNA RosarioSIS (francoisjacquet) Fixed in 12.9
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
francoisjacquet RosarioSIS 12.9
2 records Highest priority Priority LOW 2 LOW
Other records, highest priority first
- TI-2026-84852 SQL injection in RosarioSIS attendance absence reportPriority LOW 37
Timeline
- 2026-11-03 Threatist record created from CVE-2026-121732
- 2026-11-04 Alias added: GHSA-mfq4-wm65-76f5
References
Patch 1
Other 5
- https://github.com/francoisjacquet/rosariosis
- https://gitlab.com/francoisjacquet/rosariosis/-/issues/376
- https://github.com/francoisjacquet/rosariosis/blob/v12.8.1/modules/Student_Billing/MassAssignFees.php#L15
- https://github.com/francoisjacquet/rosariosis/blob/v12.8.1/modules/Student_Billing/MassAssignPayments.php#L16
- RosarioSIS v12.9 Release Notes
More francoisjacquet vulnerabilities
- TI-2021-20041 An unauthenticated SQL Injection vulnerability in Rosario Student Information System (aka… CVSS 3.1CRITICAL 9.8
- TI-2023-00941 Exposure of Sensitive Information to an Unauthorized Actor in francoisjacquet/rosariosis CVSS 3.1HIGH 7.5
- TI-2026-62651 RosarioSIS before 12.9 Path Traversal in File Deletion via filename Parameter CVSS 4.0HIGH 7.1
- TI-2021-20153 An unauthenticated SQL Injection vulnerability exists in RosarioSIS before 7.6.1 via the… CVSS 3.1CRITICAL 9.8
- TI-2023-14071 RosarioSIS 10.8.4 is vulnerable to CSV injection via the Periods Module. CVSS 3.1MEDIUM 5.4
- TI-2026-80079 Missing authorization in RosarioSIS teacher save handlers CVSS 4.0MEDIUM 5.3
Sources
- CVE-2026-121732 · CVE Program
- CVE-2026-121732 · NVD
- FIRST EPSS
- GHSA-mfq4-wm65-76f5 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences