CVE-2026-121732

Low

Description

RosarioSIS before 12.9 contains an improper authorization vulnerability that allows school-scoped administrators to assign fees and payments to students of other schools via MassAssignFees.php and MassAssignPayments.php. Attackers can substitute foreign student IDs in the student[] POST array of a modfunc=save request to alter other schools' student billing balances, breaking school isolation.

SeverityLow

CVSS2.7

Exploit probability—

ProductRosarioSIS

PublishedNov 3, 2026

First seenNov 4, 2026

Weakness typeCWE-639Authorization bypass through user-controlled key

How to fix

Update

francoisjacquet RosarioSIS12.9 or later

Patches

github.com/francoisjacquet/rosariosis/commit/a8bb460aacb11661934e6e91fbe0d8158fbc0c4f

Vendor advisories

github.com/francoisjacquet/rosariosis/releases/tag/v12.9

Affected products

Product	Affected versions	Fixed in
francoisjacquet RosarioSIS	v < 12.9	12.9

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.