---
id: CVE-2026-116010
title: RosarioSIS before 12.9.1 Missing Authorization in Teacher Save Handlers
summary: >-
  RosarioSIS before 12.9.1 contains a missing authorization vulnerability that
  allows authenticated teachers to write records for students outside their
  course period by supplying arbitrary student IDs. Attackers can modify the
  st_arr, val…
severity: medium
cvss: 4.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N'
cvssSource: cna
cwe:
  - CWE-639
vendor: francoisjacquet
product: RosarioSIS
affected:
  - RosarioSIS < 12.9.1
published: '2026-10-24'
updated: '2026-10-24'
sourceUpdated: '2026-10-24T11:40:29.488Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-116010'
references:
  - url: 'https://gitlab.com/francoisjacquet/rosariosis/-/issues/377'
  - url: >-
      https://gitlab.com/francoisjacquet/rosariosis/-/commit/37b67dad841479799cc41bc969c7aea6626bab66
  - url: >-
      https://gitlab.com/francoisjacquet/rosariosis/-/blob/v12.9/modules/Discipline/MakeReferral.php#L75
  - url: 'https://gitlab.com/francoisjacquet/rosariosis/-/releases/v12.9.1'
  - url: >-
      https://www.vulncheck.com/advisories/rosariosis-before-12.9.1-missing-authorization-in-teacher-save-handlers
    label: >-
      VulnCheck Advisory: RosarioSIS before 12.9.1 Missing Authorization in
      Teacher Save Handlers
tags:
  - cve.org
ingestedAt: '2026-10-24T11:57:47.031Z'
---

## Overview

RosarioSIS before 12.9.1 contains a missing authorization vulnerability that allows authenticated teachers to write records for students outside their course period by supplying arbitrary student IDs. Attackers can modify the st_arr, values, or attendance POST arrays in MakeReferral.php, EnterEligibility.php, InputFinalGrades.php, and TakeAttendance.php to create referrals, eligibility codes, attendance and final grades for any student in the school.

## Affected

- `RosarioSIS < 12.9.1`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.