# CVE-2026-10168: BrinaryBrains School Student Management System IDOR in Parents controller

Source: https://junglewise.ai/threats/cve-2026-10168-brinarybrains-school-student-management-system-idor-in-parents  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-31. Updated: 2026-05-31  
License: CC BY 4.0 with a link back

CVE-2026-10168 · Severity: medium · CVSS 6.3 · Published 2026-05-31

A security flaw exists in the BrinaryBrains School Student Management System, a platform used by educational institutions to manage student records and communications. This vulnerability allows a logged-in parent to view the private academic marks and class schedules of any other student in the system. By simply changing a number in the web address, an unauthorized user can access sensitive student performance data, leading to a significant privacy breach and potential reputational damage for the school.

## Quick answers

**Is CVE-2026-10168 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-10168 being exploited in the wild.

**How severe is CVE-2026-10168?** Medium severity, with a CVSS score of 6.3, published 31 May 2026.

**Which products and versions are affected?** BrinaryBrains School Student Management System up to 1e70e5ad1125b86dca4ee086eb6bb121f17708b6.

**Is there a fix for CVE-2026-10168?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-10168 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-10168?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An Insecure Direct Object Reference (IDOR) vulnerability exists in the 'marks' and 'class_routine' methods of the Parents controller (application/controllers/Parents.php). The application accepts a student ID via the 'param1' URL argument and retrieves the associated records without verifying if the requesting parent is authorized to view that specific student's data. A remote attacker with parent-level authentication can exploit this by enumerating student IDs to perform horizontal privilege escalation. This allows for the unauthorized disclosure of sensitive academic information and class routines. As of the advisory date, the vendor has not responded to the issue report, and no official patch is available.

## Affected products

- BrinaryBrains School Student Management System up to 1e70e5ad1125b86dca4ee086eb6bb121f17708b6

## Timeline

- 2026-05-04: disclosed: Issue reported to the project maintainers on GitHub
- 2026-05-31: advisory: CVE published by VulDB/NVD

## References

- [https://github.com/OUSL-GROUP-BrinaryBrains/School-Student-Management-System/issues/25](https://github.com/OUSL-GROUP-BrinaryBrains/School-Student-Management-System/issues/25)
- [https://vuldb.com/submit/819161](https://vuldb.com/submit/819161)
- [https://vuldb.com/vuln/367422](https://vuldb.com/vuln/367422)
- [https://vuldb.com/vuln/367422/cti](https://vuldb.com/vuln/367422/cti)