{"id":"CVE-2026-121732","published":"2026-11-03T23:17:36.987","lastModified":"2026-11-03T23:17:37.127","description":"RosarioSIS before 12.9 contains an improper authorization vulnerability that allows school-scoped administrators to assign fees and payments to students of other schools via MassAssignFees.php and MassAssignPayments.php. Attackers can substitute foreign student IDs in the student[] POST array of a modfunc=save request to alter other schools' student billing balances, breaking school isolation.","cvssScore":2.7,"cvssSeverity":"LOW","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N","cwes":["CWE-639"],"vendors":[],"products":[],"references":[{"url":"https://github.com/francoisjacquet/rosariosis","tags":[]},{"url":"https://github.com/francoisjacquet/rosariosis/blob/v12.8.1/modules/Student_Billing/MassAssignFees.php#L15","tags":[]},{"url":"https://github.com/francoisjacquet/rosariosis/blob/v12.8.1/modules/Student_Billing/MassAssignPayments.php#L16","tags":[]},{"url":"https://github.com/francoisjacquet/rosariosis/commit/a8bb460aacb11661934e6e91fbe0d8158fbc0c4f","tags":[]},{"url":"https://github.com/francoisjacquet/rosariosis/releases/tag/v12.9","tags":[]},{"url":"https://gitlab.com/francoisjacquet/rosariosis/-/issues/376","tags":[]},{"url":"https://www.vulncheck.com/advisories/rosariosis-before-12.9-improper-authorization-via-student-billing-mass-assignment","tags":[]}],"exploitRefs":[{"url":"https://github.com/francoisjacquet/rosariosis","tags":[]},{"url":"https://github.com/francoisjacquet/rosariosis/blob/v12.8.1/modules/Student_Billing/MassAssignFees.php#L15","tags":[]},{"url":"https://github.com/francoisjacquet/rosariosis/blob/v12.8.1/modules/Student_Billing/MassAssignPayments.php#L16","tags":[]},{"url":"https://github.com/francoisjacquet/rosariosis/commit/a8bb460aacb11661934e6e91fbe0d8158fbc0c4f","tags":[]},{"url":"https://github.com/francoisjacquet/rosariosis/releases/tag/v12.9","tags":[]}],"hasPoc":true,"ai":null}