Is CVE-2026-10169 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-10169 being exploited in the wild.

How severe is CVE-2026-10169?

Low severity, with a CVSS score of 3.7, published 31 May 2026.

Which products and versions are affected?

BrinaryBrains School Student Management System up to 1e70e5ad1125b86dca4ee086eb6bb121f17708b6.

Is there a fix for CVE-2026-10169?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-10169 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-10169?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-10169: BrinaryBrains School Student Management System weak password recovery

CVE-2026-10169 · Severity: low · CVSS 3.7 · Published 2026-05-31

The BrinaryBrains School Student Management System, used for managing educational records, contains a flaw in its password recovery process. An attacker can exploit this to identify valid user email addresses and forcibly reset passwords for any account without authorization. This can lead to legitimate users being locked out of their accounts and potential disruption of school administrative operations.

Quick answers

Is CVE-2026-10169 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-10169 being exploited in the wild.
How severe is CVE-2026-10169?: Low severity, with a CVSS score of 3.7, published 31 May 2026.
Which products and versions are affected?: BrinaryBrains School Student Management System up to 1e70e5ad1125b86dca4ee086eb6bb121f17708b6.
Is there a fix for CVE-2026-10169?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-10169 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-10169?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A business logic vulnerability exists in the 'ajax_forgot_password' function within 'application/controllers/Login.php'. The endpoint processes POST requests containing an email address and immediately updates the database with a new, randomly generated password without requiring a reset token, CAPTCHA, or secondary verification. Furthermore, the application returns different HTTP responses (Success vs. 500 Internal Server Error) based on whether the email exists, enabling account enumeration. An attacker can remotely trigger these resets to cause a denial-of-service for specific users. As of the advisory date, no patch has been released by the vendor.

Affected products

BrinaryBrains School Student Management System up to 1e70e5ad1125b86dca4ee086eb6bb121f17708b6

Timeline

2026-05-05: disclosed: Issue reported to the project maintainers on GitHub.
2026-05-31: advisory: CVE published via VulDB/NVD.

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.