---
id: CVE-2026-121732
title: >-
  RosarioSIS before 12.9 Improper Authorization via Student Billing Mass
  Assignment
summary: >-
  RosarioSIS before 12.9 contains an improper authorization vulnerability that
  allows school-scoped administrators to assign fees and payments to students of
  other schools via MassAssignFees.php and MassAssignPayments.php. Attackers can
  su…
severity: low
cvss: 2.7
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N'
cvssSource: cna
cwe:
  - CWE-639
vendor: francoisjacquet
product: RosarioSIS
affected:
  - RosarioSIS < 12.9
published: '2026-11-03'
updated: '2026-11-03'
sourceUpdated: '2026-11-03T22:55:37.220Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-121732'
references:
  - url: >-
      https://github.com/francoisjacquet/rosariosis/commit/a8bb460aacb11661934e6e91fbe0d8158fbc0c4f
    label: Patch Commit
  - url: 'https://github.com/francoisjacquet/rosariosis'
  - url: 'https://gitlab.com/francoisjacquet/rosariosis/-/issues/376'
  - url: >-
      https://github.com/francoisjacquet/rosariosis/blob/v12.8.1/modules/Student_Billing/MassAssignFees.php#L15
  - url: >-
      https://github.com/francoisjacquet/rosariosis/blob/v12.8.1/modules/Student_Billing/MassAssignPayments.php#L16
  - url: 'https://github.com/francoisjacquet/rosariosis/releases/tag/v12.9'
    label: RosarioSIS v12.9 Release Notes
  - url: >-
      https://www.vulncheck.com/advisories/rosariosis-before-12.9-improper-authorization-via-student-billing-mass-assignment
    label: >-
      VulnCheck Advisory: RosarioSIS before 12.9 Improper Authorization via
      Student Billing Mass Assignment
tags:
  - cve.org
epss: 0.00236
epssPercentile: 0.14606
ingestedAt: '2026-11-05T20:33:06.610Z'
---

## Overview

RosarioSIS before 12.9 contains an improper authorization vulnerability that allows school-scoped administrators to assign fees and payments to students of other schools via MassAssignFees.php and MassAssignPayments.php. Attackers can substitute foreign student IDs in the student[] POST array of a modfunc=save request to alter other schools' student billing balances, breaking school isolation.

## Affected

- `RosarioSIS < 12.9`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.