CVE-2026-91107: openSIS Classic 9.3 - Insecure Direct Object Reference (IDOR)
openSIS Classic 9.3 allows an authenticated user with the built-in teacher role can select an arbitrary staff record through staffid and cause the School Information update path to reset that selected account's password.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated user assigned the built-in teacher role can exploit it. The issue does not require user interaction and can be reached over the network.
What access does an attacker gain through exploitation?
The attacker can select an arbitrary staff record using staff_id and trigger the School Information update path to reset that account's password. This can enable takeover of the selected staff account.
Is a default role affected?
Yes. The affected role is the built-in teacher role, so deployments that allow users to authenticate with that role are exposed.
What should be done if patching is not immediately possible?
Restrict access to accounts with the built-in teacher role and closely monitor School Information update activity and password resets for staff accounts. Investigate unexpected password resets, especially those affecting staff records not associated with the acting teacher.