CVE-2026-121732— RosarioSIS before 12.9 Improper Authorization via Student Billing Mass Assignment

Quick assessment

Affected

francoisjacquet RosarioSIS

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

RosarioSIS 12.9 之前的版本存在一个授权不当漏洞，允许学校范围内的管理员通过 MassAssignFees.php 和 MassAssignPayments.php 将费用与付款分配给其他学校的学生。攻击者可以在 modfunc=save 请求的 student[] POST 数组中替换其他学校的学生 ID，从而篡改其他学校学生的账单余额，破坏学校之间的隔离机制。

CVSS 2.7 · Low Updated Nov 04, 2026

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

RosarioSIS before 12.9 Improper Authorization via Student Billing Mass Assignment

Source: CVE Program / CVE List V5

Vulnerability Description

RosarioSIS before 12.9 contains an improper authorization vulnerability that allows school-scoped administrators to assign fees and payments to students of other schools via MassAssignFees.php and MassAssignPayments.php. Attackers can substitute foreign student IDs in the student[] POST array of a modfunc=save request to alter other schools' student billing balances, breaking school isolation.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N

Source: CVE Program / CVE List V5

Vulnerability Type

通过用户控制密钥绕过授权机制

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
francoisjacquet	RosarioSIS	0 ~ 12.9	-

II. Public POCs for CVE-2026-121732

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-121732

请登录查看更多情报信息。

Vendor Pages for CVE-2026-121732 (2)

Other References for CVE-2026-121732 (5)

https://github.com/francoisjacquet/rosariosis/blob/v12.8.1/modules/Student_Billing/MassAssignFees.php#L15 technical-description
https://github.com/francoisjacquet/rosariosis/blob/v12.8.1/modules/Student_Billing/MassAssignPayments.php#L16 technical-description
https://gitlab.com/francoisjacquet/rosariosis/-/issues/376 issue-tracking
https://github.com/francoisjacquet/rosariosis/commit/a8bb460aacb11661934e6e91fbe0d8158fbc0c4f patch
https://www.vulncheck.com/advisories/rosariosis-before-12.9-improper-authorization-via-student-billing-mass-assignment third-party-advisory

https://www.cve.org/CVERecord?id=CVE-2026-121732

IV. Related Vulnerabilities

Same product: RosarioSIS

Same vendor: francoisjacquet

Same weakness: CWE-639