SKUUL SCHOOL MANAGEMENT SYSTEM · CVE-2026-124502 · Other
NO FIX YET · SEE WHAT TO DO
The Skuul School Management System has a missing authorization check in its graduation reset handler, so a request can change a student's graduation record without the right permissions. The sources say the exploit has been disclosed publicly and may be used remotely.
first public Nov 9, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Schools or organizations running the self-hosted Skuul School Management System at version 2.6.3 or earlier are exposed when the graduation reset endpoint is reachable. Installations already on 3.0.0 or later are not covered by this flaw. The sources do not say which default configuration, if any, is needed.
Not affected if version-3.0.0-or-later
Who cares education, php, self-hosted, skuul
2.6.3 are affected.resetGraduation in app/Http/Controllers/GraduationController.php and see whether the action checks the user's role.3.0.0 (the sources name this version; the patch is commit b42f2c80a8e5e01ca6e607bbd97f137ede368ac9).A security vulnerability has been detected in yungifez Skuul School Management System up to 2.6.3. Affected by this vulnerability is the function GraduationController::resetGraduation of the file app/Http/Controllers/GraduationController.php of the component Delete Handler. Such manipulation of the argument student leads to missing authorization. The attack can be executed remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 3.0.0 addresses this issue. The name of the patch is b42f2c80a8e5e01ca6e607bbd97f137ede368ac9. The affected component should be upgraded.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.