{"id":"CVE-2026-116010","kind":"vulnerability","aliases":["CVE-2026-116010"],"related":[],"title":"RosarioSIS: teachers can write records for students outside their classes","description":"RosarioSIS before 12.9.1 contains a missing authorization vulnerability that allows authenticated teachers to write records for students outside their course period by supplying arbitrary student IDs. Attackers can modify the st_arr, values, or attendance POST arrays in MakeReferral.php, EnterEligibility.php, InputFinalGrades.php, and TakeAttendance.php to create referrals, eligibility codes, attendance and final grades for any student in the school.","summary":"RosarioSIS before 12.9.1 lets an authenticated teacher submit arbitrary student IDs to several forms, so they can create referrals, eligibility codes, attendance and final grades for any student in the school. The attacker gets unauthorized write access to student records from a normal teacher account.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["education","package","php","rosariosis","self-hosted"],"not_affected_if":["no-teacher-accounts","rosariosis-12.9.1-or-later"],"how_to_check":"- Check the installed RosarioSIS version; it is affected if it is below `12.9.1`\n- Review the teacher role's permissions and which accounts hold it","fix":"- Upgrade RosarioSIS to `12.9.1` or later\n- Until upgraded, restrict teacher accounts to trusted staff","status":"open","published_at":"2026-10-24T12:16:56+00:00","first_seen_at":"2026-10-24T12:47:58+00:00","triaged_at":"2026-10-25T04:18:45+00:00","updated_at":"2026-10-25T04:18:45+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-25T04:18:45Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade RosarioSIS to `12.9.1` or later\n- Until upgraded, restrict teacher accounts to trusted staff","reach":"network","title":"RosarioSIS: teachers can write records for students outside their classes","impact":"medium","summary":"RosarioSIS before 12.9.1 lets an authenticated teacher submit arbitrary student IDs to several forms, so they can create referrals, eligibility codes, attendance and final grades for any student in the school. The attacker gets unauthorized write access to student records from a normal teacher account.","category":"package","nicknames":[],"who_cares":["rosariosis","self-hosted","education","php"],"confidence":0.8,"needs_auth":"yes","worst_case":"Teacher can alter any student's grades, attendance and referrals","analyst_note":"","how_to_check":"- Check the installed RosarioSIS version; it is affected if it is below `12.9.1`\n- Review the teacher role's permissions and which accounts hold it","needs_analyst":false,"not_affected_if":["rosariosis-12.9.1-or-later","no-teacher-accounts"],"who_is_affected":"Schools running RosarioSIS before 12.9.1 where teachers have login accounts. Exposure depends on teachers being able to reach MakeReferral.php, EnterEligibility.php, InputFinalGrades.php or TakeAttendance.php, which is the default for teacher accounts. Installations already on 12.9.1 or later are not affected.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"unknown"},"cost_usd":0.000612,"input_tokens":3375,"output_tokens":550,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-116010':13A,16A '-2026':12A,15A '12.9.1':26B,71C 'access':60B 'account':68B 'allow':78C 'arbitrari':32B,92C 'arr':100C 'array':105C 'attack':56B,95C 'attend':45B,103C,117C 'authent':29B,79C 'author':75C 'class':10A 'code':44B,116C 'contain':72C 'cours':88C 'creat':41B,113C 'cve':11A,14A 'educ':17B 'elig':43B,115C 'entereligibility.php':108C 'final':47B,119C 'form':37B 'get':57B 'grade':48B,120C 'host':23B 'id':34B,94C 'inputfinalgrades.php':109C 'let':27B 'makereferral.php':107C 'miss':74C 'modifi':97C 'normal':66B 'outsid':8A,86C 'packag':18B 'period':89C 'php':19B 'post':104C 'record':5A,63B,83C 'referr':42B,114C 'rosariosi':1A,20B,24B,69C 'school':54B,126C 'self':22B 'self-host':21B 'sever':36B 'st':99C 'student':7A,33B,51B,62B,85C,93C,123C 'submit':31B 'suppli':91C 'takeattendance.php':111C 'teacher':2A,30B,67B,80C 'unauthor':58B 'valu':101C 'vulner':76C 'write':4A,59B,82C","nicknames":[],"mitigations":[],"who_affected":"Schools running RosarioSIS before 12.9.1 where teachers have login accounts. Exposure depends on teachers being able to reach MakeReferral.php, EnterEligibility.php, InputFinalGrades.php or TakeAttendance.php, which is the default for teacher accounts. Installations already on 12.9.1 or later are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-24T12:16:56+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116010","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116010","severity":null,"published_at":"2026-10-24T12:16:56+00:00","modified_at":"2026-10-24T12:16:56+00:00","first_seen_at":"2026-10-24T12:47:58+00:00","fetched_at":"2026-10-24T12:47:58+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}