CVE-2026-2015: Portabilis i-Educar Final Status Import FinalStatusImportService.php improper authorization
A weakness has been identified in Portabilis i-Educar up to 2.10. Affected is an unknown function of the file FinalStatusImportService.php of the component Final Status Import. Executing a manipulation of the argument schoolid can lead to improper authorization. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks. Upgrading to version 2.11.0 is able to address this issue. Upgrading the affected component is advised. The vendor explains, that "[t]he reported attack vector was tested against the corrected code, and the previously described behavior could no longer be reproduced".
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Portabilis i-Educar Final Status Importto a version that resolves this vulnerability.Fixed in 2.11.0
Event History
Frequently Asked Questions
What is the severity of CVE-2026-2015?
CVE-2026-2015 has been categorized as a moderate severity vulnerability affecting Portabilis i-Educar up to version 2.10.
What type of vulnerability is CVE-2026-2015?
CVE-2026-2015 is classified as an improper authorization vulnerability within the FinalStatusImportService.php component.
How do I fix CVE-2026-2015?
To fix CVE-2026-2015, upgrade to a version of Portabilis i-Educar newer than 2.10 where the vulnerability has been addressed.
Which versions of Portabilis i-Educar are affected by CVE-2026-2015?
CVE-2026-2015 affects all versions of Portabilis i-Educar up to and including version 2.10.
What impact does CVE-2026-2015 have on my system?
CVE-2026-2015 could allow unauthorized users to manipulate data through the Final Status Import feature.