CVE-2026-124502: yungifez Skuul School Management System Delete GraduationController.php resetGraduation authorization
A security vulnerability has been detected in yungifez Skuul School Management System up to 2.6.3. Affected by this vulnerability is the function GraduationController::resetGraduation of the file app/Http/Controllers/GraduationController.php of the component Delete Handler. Such manipulation of the argument student leads to missing authorization. The attack can be executed remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 3.0.0 addresses this issue. The name of the patch is b42f2c80a8e5e01ca6e607bbd97f137ede368ac9. The affected component should be upgraded.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
yungifez Skuul School Management Systemto a version that resolves this vulnerability.Fixed in 3.0.0Patch b42f2c80a8e5e01ca6e607bbd97f137ede368ac9
Event History
Frequently Asked Questions
What level of access does an attacker need to exploit this issue?
The attacker needs low-level privileges. Exploitation can be performed remotely and does not require user interaction.
Which deployments are affected and what is the remediation?
Skuul School Management System versions up to 2.6.3 are affected. Upgrade the affected component to version 3.0.0, which includes patch b42f2c80a8e5e01ca6e607bbd97f137ede368ac9.
What could an attacker do through the vulnerable function?
By manipulating the student argument supplied to GraduationController::resetGraduation in the Delete Handler, an authenticated low-privileged attacker can trigger an operation without the required authorization. The reported impact is integrity loss.
How urgent is remediation?
A public exploit has been disclosed and may be used. Prioritize upgrading affected instances, especially where low-privileged accounts can access the application remotely.