Live › vulnerability › CVE-2026-117028
Skuul School Management System through version 2.6.5 has an access control flaw in its ResultChecker::checkResult method. A logged-in student can change the studentId parameter to view another student's examination results and marks.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 14:30 UTC. All times on this page are UTC.
Schools or organisations that run Skuul School Management System through version 2.6.5 with student logins are exposed, since the flaw requires an authenticated student account. Installations on a newer version, or those without student accounts, are not described as affected by the sources.
No product ranges from the sources yet.
2.6.5 or earlier if affectedNo fix yet, per the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Skuul School Management System through version 2.6.5 is vulnerable to incorrect access control in the ResultChecker::checkResult method. An authenticated student can manipulate the studentId parameter to retrieve another student's examination results, including examination marks, without authorization.
This page as .md · .json · in your agent: get_signal("CVE-2026-117028")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.