Live › vulnerability › CVE-2026-121732
RosarioSIS before 12.9 lets a school-scoped administrator assign fees and payments to students at other schools by substituting foreign student IDs in a POST request to the mass-assign fee and payment pages. An attacker can change other schools' student billing balances, which breaks the isolation between schools.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 23:45 UTC. All times on this page are UTC.
Schools that run RosarioSIS with more than one school in the same installation and give school-scoped administrator accounts access to the fee and payment mass-assign functions. A single-school installation or one where only fully trusted administrators can log in is less exposed. unknown whether the sources describe further conditions.
No product ranges from the sources yet.
12.912.9 or later (per the NVD description, fixed in 12.9)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
RosarioSIS before 12.9 contains an improper authorization vulnerability that allows school-scoped administrators to assign fees and payments to students of other schools via MassAssignFees.php and MassAssignPayments.php. Attackers can substitute foreign student IDs in the student[] POST array of a modfunc=save request to alter other schools' student billing balances, breaking school isolation.
This page as .md · .json · in your agent: get_signal("CVE-2026-121732")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.