{"id":"CVE-2026-124502","kind":"vulnerability","aliases":["CVE-2026-124502"],"related":[],"title":"Skuul School Management System: missing authorization lets remote users reset graduations","description":"A security vulnerability has been detected in yungifez Skuul School Management System up to 2.6.3. Affected by this vulnerability is the function GraduationController::resetGraduation of the file app/Http/Controllers/GraduationController.php of the component Delete Handler. Such manipulation of the argument student leads to missing authorization. The attack can be executed remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 3.0.0 addresses this issue. The name of the patch is b42f2c80a8e5e01ca6e607bbd97f137ede368ac9. The affected component should be upgraded.","summary":"The Skuul School Management System has a missing authorization check in its graduation reset handler, so a request can change a student's graduation record without the right permissions. The sources say the exploit has been disclosed publicly and may be used remotely.","severity":"medium","cvss":4.3,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Skuul School Management System","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["education","other","php","self-hosted","skuul"],"not_affected_if":["version-3.0.0-or-later"],"how_to_check":"- Check the installed Skuul version in the project's composer.json or release tag; versions up to `2.6.3` are affected.\n- Look for `resetGraduation` in `app/Http/Controllers/GraduationController.php` and see whether the action checks the user's role.","fix":"- Upgrade Skuul School Management System to `3.0.0` (the sources name this version; the patch is commit b42f2c80a8e5e01ca6e607bbd97f137ede368ac9).","status":"open","published_at":"2026-11-09T00:18:01+00:00","first_seen_at":"2026-11-09T00:23:39+00:00","triaged_at":"2026-11-09T00:25:07+00:00","updated_at":"2026-11-09T00:25:07+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-11-09T00:25:07Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Skuul School Management System to `3.0.0` (the sources name this version; the patch is commit b42f2c80a8e5e01ca6e607bbd97f137ede368ac9).","reach":"internet","title":"Skuul School Management System: missing authorization lets remote users reset graduations","impact":"medium","summary":"The Skuul School Management System has a missing authorization check in its graduation reset handler, so a request can change a student's graduation record without the right permissions. The sources say the exploit has been disclosed publicly and may be used remotely.","audience":"businesses","category":"other","nicknames":[],"who_cares":["skuul","php","self-hosted","education"],"confidence":0.6,"fix_status":"available","needs_auth":"unknown","worst_case":"A remote user resets student graduation records without authorization.","analyst_note":"Confirm whether an account is needed to reach the endpoint and whether the exploit is public; check the patch and release notes linked from NVD.","how_to_check":"- Check the installed Skuul version in the project's composer.json or release tag; versions up to `2.6.3` are affected.\n- Look for `resetGraduation` in `app/Http/Controllers/GraduationController.php` and see whether the action checks the user's role.","plain_action":"","product_name":"Skuul School Management System","needs_analyst":true,"not_affected_if":["version-3.0.0-or-later"],"who_is_affected":"Schools or organizations running the self-hosted Skuul School Management System at version 2.6.3 or earlier are exposed when the graduation reset endpoint is reachable. Installations already on 3.0.0 or later are not covered by this flaw. The sources do not say which default configuration, if any, is needed.","user_interaction":"no","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000788,"input_tokens":4678,"output_tokens":641,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-124502':14A,17A '-2026':13A,16A '2.6.3':86C '3.0.0':134C 'address':135C 'affect':87C,146C 'app/http/controllers/graduationcontroller.php':99C 'argument':109C 'attack':116C 'author':6A,37B,114C 'b42f2c80a8e5e01ca6e607bbd97f137ede368ac9':144C 'chang':48B 'check':38B 'compon':102C,147C 'cve':12A,15A 'delet':103C 'detect':77C 'disclos':65B,125C 'educ':22B 'execut':119C 'exploit':62B,122C 'file':98C 'function':93C 'graduat':11A,41B,52B 'graduationcontrol':94C 'handler':43B,104C 'host':27B 'issu':137C 'lead':111C 'let':7A 'manag':3A,32B,82C 'management':20A 'manipul':106C 'may':68B,128C 'miss':5A,36B,113C 'name':139C 'patch':142C 'permiss':57B 'php':24B 'public':66B,126C 'record':53B 'remot':8A,71B,120C 'request':46B 'reset':10A,42B 'resetgradu':95C 'right':56B 'say':60B 'school':2A,19A,31B,81C 'secur':73C 'self':26B 'self-host':25B 'skuul':1A,18A,28B,30B,80C 'sourc':59B 'student':50B,110C 'system':4A,21A,33B,83C 'upgrad':131C,150C 'use':70B,130C 'user':9A 'version':133C 'vulner':74C,90C 'without':54B 'yungifez':79C","nicknames":[],"mitigations":[],"who_affected":"Schools or organizations running the self-hosted Skuul School Management System at version 2.6.3 or earlier are exposed when the graduation reset endpoint is reachable. Installations already on 3.0.0 or later are not covered by this flaw. The sources do not say which default configuration, if any, is needed.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["schoolmanagementsystem","skuulschoolmanagementsystem"],"ptokens":["management","school","skuul","system"],"labels":["education","medium","other","php","selfhosted","skuul","vendor"],"campaign_type":null,"search_a":"'-124502':14A,17A '-2026':13A,16A 'author':6A 'cve':12A,15A 'graduat':11A 'let':7A 'manag':3A 'management':20A 'miss':5A 'remot':8A 'reset':10A 'school':2A,19A 'skuul':1A,18A 'system':4A,21A 'user':9A","search_b":"'author':37B 'chang':48B 'check':38B 'disclos':65B 'educ':22B 'exploit':62B 'graduat':41B,52B 'handler':43B 'host':27B 'manag':32B 'may':68B 'miss':36B 'permiss':57B 'php':24B 'public':66B 'record':53B 'remot':71B 'request':46B 'reset':42B 'right':56B 'say':60B 'school':31B 'self':26B 'self-host':25B 'skuul':28B,30B 'sourc':59B 'student':50B 'system':33B 'use':70B 'without':54B","search_c":"'2.6.3':86C '3.0.0':134C 'address':135C 'affect':87C,146C 'app/http/controllers/graduationcontroller.php':99C 'argument':109C 'attack':116C 'author':114C 'b42f2c80a8e5e01ca6e607bbd97f137ede368ac9':144C 'compon':102C,147C 'delet':103C 'detect':77C 'disclos':125C 'execut':119C 'exploit':122C 'file':98C 'function':93C 'graduationcontrol':94C 'handler':104C 'issu':137C 'lead':111C 'manag':82C 'manipul':106C 'may':128C 'miss':113C 'name':139C 'patch':142C 'public':126C 'remot':120C 'resetgradu':95C 'school':81C 'secur':73C 'skuul':80C 'student':110C 'system':83C 'upgrad':131C,150C 'use':130C 'version':133C 'vulner':74C,90C 'yungifez':79C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-09T00:18:01+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-124502","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124502","severity":null,"published_at":"2026-11-09T00:18:01+00:00","modified_at":"2026-11-09T00:18:01+00:00","first_seen_at":"2026-11-09T00:23:39+00:00","fetched_at":"2026-11-09T00:23:39+00:00","note":null}],"documents":[{"id":104656,"url":"https://github.com/yungifez/skuul/commit/b42f2c80a8e5e01ca6e607bbd97f137ede368ac9","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":104657,"url":"https://github.com/yungifez/skuul/releases/tag/v3.0.0","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}