CVE-2026-116010: RosarioSIS before 12.9.1 Missing Authorization in Teacher Save Handlers
RosarioSIS before 12.9.1 contains a missing authorization vulnerability that allows authenticated teachers to write records for students outside their course period by supplying arbitrary student IDs. Attackers can modify the starr, values, or attendance POST arrays in MakeReferral.php, EnterEligibility.php, InputFinalGrades.php, and TakeAttendance.php to create referrals, eligibility codes, attendance and final grades for any student in the school.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated user with a teacher account can exploit it. The issue affects access controls for student records and does not require interaction from another user.
What records can an attacker alter?
A teacher can submit arbitrary student IDs to create referrals, eligibility codes, attendance records, or final grades for students outside the teacher's assigned course period. The affected handlers are MakeReferral.php, EnterEligibility.php, InputFinalGrades.php, and TakeAttendance.php.
Which RosarioSIS versions are affected?
RosarioSIS versions before 12.9.1 are affected. The provided information does not identify any affected configuration prerequisites beyond use of the vulnerable application version.