CVE-2026-121732
RosarioSIS before 12.9 Improper Authorization via Student Billing Mass Assignment
CVSS Score
2.7
EPSS Score
0.0%
EPSS Percentile
0th
RosarioSIS before 12.9 contains an improper authorization vulnerability that allows school-scoped administrators to assign fees and payments to students of other schools via MassAssignFees.php and MassAssignPayments.php. Attackers can substitute foreign student IDs in the student[] POST array of a modfunc=save request to alter other schools' student billing balances, breaking school isolation.
| CWE | CWE-639 |
| Vendor | francoisjacquet |
| Product | rosariosis |
| Published | Nov 3, 2026 |
Stay Ahead of the Next One
Get instant alerts for francoisjacquet rosariosis
Be the first to know when new low vulnerabilities affecting francoisjacquet rosariosis are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N Attack Vector
Network
Attack Complexity
Low
Privileges Required
High
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
Low
Availability
None
Affected Versions
francoisjacquet / RosarioSIS
0 < 12.9
References
github.com: https://github.com/francoisjacquet/rosariosis/commit/a8bb460aacb11661934e6e91fbe0d8158fbc0c4f github.com: https://github.com/francoisjacquet/rosariosis gitlab.com: https://gitlab.com/francoisjacquet/rosariosis/-/issues/376 github.com: https://github.com/francoisjacquet/rosariosis/blob/v12.8.1/modules/Student_Billing/MassAssignFees.php#L15 github.com: https://github.com/francoisjacquet/rosariosis/blob/v12.8.1/modules/Student_Billing/MassAssignPayments.php#L16 github.com: https://github.com/francoisjacquet/rosariosis/releases/tag/v12.9 vulncheck.com: https://www.vulncheck.com/advisories/rosariosis-before-12.9-improper-authorization-via-student-billing-mass-assignment
Credits
harunmansor François Jacquet