CVE-2026-116010

Medium

Description

RosarioSIS before 12.9.1 contains a missing authorization vulnerability that allows authenticated teachers to write records for students outside their course period by supplying arbitrary student IDs. Attackers can modify the st_arr, values, or attendance POST arrays in MakeReferral.php, EnterEligibility.php, InputFinalGrades.php, and TakeAttendance.php to create referrals, eligibility codes, attendance and final grades for any student in the school.

SeverityMedium

CVSS4.3

Exploit probability—

ProductRosarioSIS

PublishedOct 24, 2026

First seenOct 24, 2026

Weakness typeCWE-639Authorization bypass through user-controlled key

How to fix

Update

francoisjacquet RosarioSIS12.9.1 or later

Patches

gitlab.com/francoisjacquet/rosariosis/-/commit/37b67dad841479799cc41bc969c7aea6626bab66

Vendor advisories

gitlab.com/francoisjacquet/rosariosis/-/releases/v12.9.1

Affected products

Product	Affected versions	Fixed in
francoisjacquet RosarioSIS	v < 12.9.1	12.9.1

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.