---
id: "CVE-2026-124502"
page: "https://infrastack.ai/live/CVE-2026-124502"
kind: "vulnerability"
aliases: ["CVE-2026-124502"]
title: "Skuul School Management System: missing authorization lets remote users reset graduations"
severity: "medium"
cvss: 4.3
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "Skuul School Management System", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["education", "other", "php", "self-hosted", "skuul"]
not_affected_if: ["version-3.0.0-or-later"]
published_at: "2026-11-09T00:18:01+00:00"
first_seen_at: "2026-11-09T00:23:39+00:00"
updated_at: "2026-11-09T00:25:07+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-124502", "first_seen_at": "2026-11-09T00:23:39+00:00"}]
exploit_sources: []
---

# Skuul School Management System: missing authorization lets remote users reset graduations

Link for people: https://infrastack.ai/live/CVE-2026-124502 (this .md is for agents)

The Skuul School Management System has a missing authorization check in its graduation reset handler, so a request can change a student's graduation record without the right permissions. The sources say the exploit has been disclosed publicly and may be used remotely.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Skuul School Management System affected range not listed fixed no fixed version listed

## How to check

- Check the installed Skuul version in the project's composer.json or release tag; versions up to `2.6.3` are affected.
- Look for `resetGraduation` in `app/Http/Controllers/GraduationController.php` and see whether the action checks the user's role.

## Fix

- Upgrade Skuul School Management System to `3.0.0` (the sources name this version; the patch is commit b42f2c80a8e5e01ca6e607bbd97f137ede368ac9).

## Timeline

- 2026-11-09T00:23:39+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-124502

## Documents

- [fix] Patch: github.com https://github.com/yungifez/skuul/commit/b42f2c80a8e5e01ca6e607bbd97f137ede368ac9
- [fix] Release notes: github.com https://github.com/yungifez/skuul/releases/tag/v3.0.0

## From the sources

A security vulnerability has been detected in yungifez Skuul School Management System up to 2.6.3. Affected by this vulnerability is the function GraduationController::resetGraduation of the file app/Http/Controllers/GraduationController.php of the component Delete Handler. Such manipulation of the argument student leads to missing authorization. The attack can be executed remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 3.0.0 addresses this issue. The name of the patch is b42f2c80a8e5e01ca6e607bbd97f137ede368ac9. The affected component should be upgraded.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_