---
id: "CVE-2026-116010"
kind: "vulnerability"
aliases: ["CVE-2026-116010"]
title: "RosarioSIS: teachers can write records for students outside their classes"
severity: "medium"
cvss: 5.3
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["education", "package", "php", "rosariosis", "self-hosted"]
not_affected_if: ["no-teacher-accounts", "rosariosis-12.9.1-or-later"]
published_at: "2026-10-24T12:16:56+00:00"
first_seen_at: "2026-10-24T12:47:58+00:00"
updated_at: "2026-10-25T04:18:45+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-116010", "first_seen_at": "2026-10-24T12:47:58+00:00"}]
---

# RosarioSIS: teachers can write records for students outside their classes

RosarioSIS before 12.9.1 lets an authenticated teacher submit arbitrary student IDs to several forms, so they can create referrals, eligibility codes, attendance and final grades for any student in the school. The attacker gets unauthorized write access to student records from a normal teacher account.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed RosarioSIS version; it is affected if it is below `12.9.1`
- Review the teacher role's permissions and which accounts hold it

## Fix

- Upgrade RosarioSIS to `12.9.1` or later
- Until upgraded, restrict teacher accounts to trusted staff

## Timeline

- 2026-10-24T12:47:58+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-116010

## From the sources

RosarioSIS before 12.9.1 contains a missing authorization vulnerability that allows authenticated teachers to write records for students outside their course period by supplying arbitrary student IDs. Attackers can modify the st_arr, values, or attendance POST arrays in MakeReferral.php, EnterEligibility.php, InputFinalGrades.php, and TakeAttendance.php to create referrals, eligibility codes, attendance and final grades for any student in the school.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_