---
id: CVE-2025-11554
title: A security vulnerability has been detected in Portabilis i-Educar up to 2.9.10
summary: >-
  A security vulnerability has been detected in Portabilis i-Educar up to
  2.9.10. Affected by this issue is some unknown functionality of the file
  app/Http/Controllers/AccessLevelController.php of the component User Type
  Handler. The manip…
severity: medium
cvss: 6.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L'
cwe:
  - CWE-266
  - CWE-277
vendor: portabilis
product: i-educar
affected:
  - 'i-educar >= 2.1.13, <= 2.9.10'
published: '2025-10-09'
updated: '2026-10-08'
sourceUpdated: '2026-10-08T13:10:00.200'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2025-11554'
references:
  - url: 'https://github.com/m3m0o/portabilis-ieducar-user-type-privilege-escalation'
    label: cna@vuldb.com
  - url: 'https://vuldb.com/?ctiid.327714'
    label: cna@vuldb.com
  - url: 'https://vuldb.com/?id.327714'
    label: cna@vuldb.com
  - url: 'https://vuldb.com/?submit.671072'
    label: cna@vuldb.com
  - url: 'https://vuldb.com/vuln/327714'
    label: >-
      VDB-327714 | Portabilis i-Educar User Type AccessLevelController.php
      insecure inherited permissions
  - url: 'https://vuldb.com/vuln/327714/cti'
    label: 'VDB-327714 | CTI Indicators (IOB, IOC, TTP, IOA)'
  - url: 'https://vuldb.com/cve/CVE-2025-11554'
    label: CVE-2025-11554 | CVE Analysis and Report
  - url: 'https://vuldb.com/submit/671072'
    label: >-
      Submit #671072 | Portabilis i-Educar 2.9.10 Improper Handling of
      Insufficient Permissions or Privileges
  - url: >-
      https://github.com/portabilis/i-educar/commit/d53365e5656f6499a4deddf89d522814655f769d
  - url: 'https://github.com/portabilis/i-educar/tree/2.12'
  - url: 'https://github.com/portabilis/i-educar/'
tags:
  - nvd
  - exploit-available
  - cve.org
epss: 0.00375
epssPercentile: 0.31288
exploits:
  github: 1
  githubRepos:
    - 'https://github.com/m3m0o/portabilis-ieducar-user-type-privilege-escalation'
  checkedAt: '2026-10-27T16:44:16.862Z'
exploitAvailable: true
ingestedAt: '2026-10-01T18:55:42.295Z'
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2025-10-09T20:34:38.023557Z'
---

## Overview

A security vulnerability has been detected in Portabilis i-Educar up to 2.9.10. Affected by this issue is some unknown functionality of the file app/Http/Controllers/AccessLevelController.php of the component User Type Handler. The manipulation leads to insecure inherited permissions. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used.

## Affected

- `i-educar >= 2.1.13, <= 2.9.10`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.