CVE-2025-11554: Portabilis i-Educar User Type AccessLevelController.php insecure inherited permissions
A security vulnerability has been detected in Portabilis i-Educar up to 2.9.10. Affected by this issue is some unknown functionality of the file app/Http/Controllers/AccessLevelController.php of the component User Type Handler. The manipulation leads to insecure inherited permissions. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-11554?
The severity of CVE-2025-11554 is classified as critical due to the potential for unauthorized access through insecure inherited permissions.
How do I fix CVE-2025-11554?
To fix CVE-2025-11554, upgrade Portabilis i-Educar to version 2.9.11 or later, where the vulnerability has been addressed.
What software is affected by CVE-2025-11554?
CVE-2025-11554 affects Portabilis i-Educar versions up to and including 2.9.10.
What component is involved in CVE-2025-11554?
CVE-2025-11554 involves the app/Http/Controllers/AccessLevelController.php component of Portabilis i-Educar.
What kind of issue does CVE-2025-11554 represent?
CVE-2025-11554 represents a security vulnerability that leads to insecure inherited permissions, potentially allowing unauthorized access.