CVE-2026-121732: RosarioSIS before 12.9 Improper Authorization via Student Billing Mass Assignment
RosarioSIS before 12.9 contains an improper authorization vulnerability that allows school-scoped administrators to assign fees and payments to students of other schools via MassAssignFees.php and MassAssignPayments.php. Attackers can substitute foreign student IDs in the student[] POST array of a modfunc=save request to alter other schools' student billing balances, breaking school isolation.
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs school-scoped administrator privileges. The issue allows that administrator to alter billing records for students belonging to other schools.
What access or request manipulation is required?
The attacker must submit a modfunc=save request to MassAssignFees.php or MassAssignPayments.php and replace values in the student[] POST array with student IDs from another school.
What is the impact on affected student records?
An attacker can assign fees or payments to students at other schools, altering their billing balances and bypassing school isolation.
Which versions are affected?
RosarioSIS versions before 12.9 are affected.