{"affected":[{"defaultStatus":"unaffected","ecosystem":"composer","packageName":"francoisjacquet/rosariosis","product":"RosarioSIS","source":"CNA: VulnCheck","vendor":"francoisjacquet","versions":[{"lessThan":"12.9.1","status":"affected","version":"0","versionType":"semver"}]}],"cveId":"CVE-2026-116010","cwes":["CWE-639"],"description":"RosarioSIS before 12.9.1 contains a missing authorization vulnerability that allows authenticated teachers to write records for students outside their course period by supplying arbitrary student IDs. Attackers can modify the st_arr, values, or attendance POST arrays in MakeReferral.php, EnterEligibility.php, InputFinalGrades.php, and TakeAttendance.php to create referrals, eligibility codes, attendance and final grades for any student in the school.","epss":{"date":"2026-11-13","percentile":0.10447,"score":0.00204},"exploits":[{"kind":"exploit","source":"ADP: CISA-ADP","url":"https://gitlab.com/francoisjacquet/rosariosis/-/work_items/377"}],"kev":null,"metrics":[{"score":5.3,"severity":"medium","source":"CNA: VulnCheck","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","version":"4.0"},{"score":4.3,"severity":"medium","source":"CNA: VulnCheck","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","version":"3.1"}],"modifiedAt":1794664309638,"publishedAt":1792842029488,"references":[{"source":"CNA: VulnCheck","tags":["issue-tracking"],"url":"https://gitlab.com/francoisjacquet/rosariosis/-/issues/377"},{"source":"CNA: VulnCheck","tags":["patch"],"url":"https://gitlab.com/francoisjacquet/rosariosis/-/commit/37b67dad841479799cc41bc969c7aea6626bab66"},{"source":"CNA: VulnCheck","tags":["technical-description"],"url":"https://gitlab.com/francoisjacquet/rosariosis/-/blob/v12.9/modules/Discipline/MakeReferral.php#L75"},{"source":"CNA: VulnCheck","tags":["release-notes"],"url":"https://gitlab.com/francoisjacquet/rosariosis/-/releases/v12.9.1"},{"source":"CNA: VulnCheck","tags":["third-party-advisory"],"url":"https://www.vulncheck.com/advisories/rosariosis-before-12.9.1-missing-authorization-in-teacher-save-handlers"},{"source":"ADP: CISA-ADP","tags":["exploit"],"url":"https://gitlab.com/francoisjacquet/rosariosis/-/work_items/377"}],"remediation":[{"kind":"fix","source":"CNA: VulnCheck","text":"The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches.","url":"https://gitlab.com/francoisjacquet/rosariosis/-/commit/37b67dad841479799cc41bc969c7aea6626bab66"}],"revision":"2cca6f5f7d5efed62db48323eb8094c29301a451f2b532c0c1954950112f675e","sources":[{"modifiedAt":1794664309638,"name":"CNA: VulnCheck","retrievedAt":1794665301308,"url":"https://www.cve.org/CVERecord?id=CVE-2026-116010"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1794665310362,"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-116010"}],"ssvc":{"assessedAt":1793285120516,"automatable":"no","exploitation":"poc","source":"ADP: CISA-ADP","technicalImpact":"partial"},"status":"published","title":"RosarioSIS before 12.9.1 Missing Authorization in Teacher Save Handlers","updatedAt":1794665310362}