RosarioSIS before 12.9 contains an improper authorization vulnerability that allows school-scoped administrators to assign fees and payments to students of other schools via MassAssignFees.php and MassAssignPayments.php. Attackers can substitute foreign student IDs in the student[] POST array of a modfunc=save request to alter other schools' student billing balances, breaking school isolation.

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required High

Attack Requirements Present

User Interaction None

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact Low

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required High

Scope Unchanged

Confidentiality Impact None

Integrity Impact Low

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

Affected Vendors & Products

Vendors Products
Rosariosis
  • Rosariosis

No data.

No data.

References
Link Providers
https://github.com/francoisjacquet/rosariosis cve-icon cve-icon
https://github.com/francoisjacquet/rosariosis/blob/v12.8.1/modules/Student_Billing/MassAssignFees.php#L15 cve-icon cve-icon
https://github.com/francoisjacquet/rosariosis/blob/v12.8.1/modules/Student_Billing/MassAssignPayments.php#L16 cve-icon cve-icon
https://github.com/francoisjacquet/rosariosis/commit/a8bb460aacb11661934e6e91fbe0d8158fbc0c4f cve-icon cve-icon
https://github.com/francoisjacquet/rosariosis/releases/tag/v12.9 cve-icon cve-icon
https://gitlab.com/francoisjacquet/rosariosis/-/issues/376 cve-icon cve-icon
https://www.vulncheck.com/advisories/rosariosis-before-12.9-improper-authorization-via-student-billing-mass-assignment cve-icon cve-icon
History

Tue, 10 Nov 2026 21:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 03 Nov 2026 23:00:00 +0000

Type Values Removed Values Added
Description RosarioSIS before 12.9 contains an improper authorization vulnerability that allows school-scoped administrators to assign fees and payments to students of other schools via MassAssignFees.php and MassAssignPayments.php. Attackers can substitute foreign student IDs in the student[] POST array of a modfunc=save request to alter other schools' student billing balances, breaking school isolation.
Title RosarioSIS before 12.9 Improper Authorization via Student Billing Mass Assignment
First Time appeared Rosariosis
Rosariosis rosariosis
Weaknesses CWE-639
CPEs cpe:2.3:a:rosariosis:rosariosis:*:*:*:*:*:*:*:*
Vendors & Products Rosariosis
Rosariosis rosariosis
References
Metrics cvssV3_1

{'score': 2.7, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N'}

cvssV4_0

{'score': 2.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N'}
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published: 2026-11-03T22:55:37.220Z

Updated: 2026-11-09T17:00:36.528Z

Reserved: 2026-11-03T22:17:04.568Z

Link: CVE-2026-121732

cve-icon Vulnrichment

Updated: 2026-11-09T16:09:12.549Z

cve-icon NVD

Status : Deferred

Published: 2026-11-03T23:17:36.987

Modified: 2026-11-09T17:17:17.503

Link: CVE-2026-121732

cve-icon Redhat

No data.