CVE-2026-91107
CriticalCVSS 9.3Summary
openSIS Classic 9.3 allows an authenticated user with the built-in teacher role to select an arbitrary staff record through staff_id and cause the School Information update path to reset that selected account's password.
Risk Assessment
An attacker with the teacher role can take over other staff accounts by resetting their passwords, leading to unauthorized access and data integrity compromise.
Recommendation
It is recommended to restrict teacher role permissions and implement access controls to prevent arbitrary staff_id selection and password resets for other accounts.
Other vulnerabilities in openSIS Classic
See all- CVE-2026-103113Medium
In OS4ED openSIS-Classic up to version 9.3, the save action function in modules/students/Student.php (General Information Tab component) is vulnerable to SQL injection via manipulation of the students argument. The attack can be performed remotely. The exploit has been publicly disclosed and may be utilized. The project was informed but has not responded.
- CVE-2026-11944Medium
A path traversal vulnerability in the legacy messaging sent-mail attachment download functionality of openSIS Classic 9.3 allows an authenticated attacker to read arbitrary files on the server via crafted path traversal sequences.
Original NVD description (English source)
openSIS Classic 9.3 allows an authenticated user with the built-in teacher role can select an arbitrary staff record through staff_id and cause the School Information update path to reset that selected account's password.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS