# CVE-2026-117028: Skuul School Management System broken object-level authorization in result checker

Source: https://junglewise.ai/threats/cve-2026-117028-skuul-school-management-system-through-version-2-6-5-is  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-30. Updated: 2026-10-30  
License: CC BY 4.0 with a link back

CVE-2026-117028 · Severity: info · Published 2026-10-30

Skuul is a multi-school management system used to track student records and examination results. A vulnerability in the result-checking feature allows an authenticated student to view another student's examination marks and scores by manipulating a request parameter, exposing confidential academic information about other students without permission.

Technologies: [Yungifez Skuul](https://junglewise.ai/threats/technologies/skuul). Vendors: [Yungifez](https://junglewise.ai/threats/vendors/yungifez).

## Quick answers

**Is CVE-2026-117028 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-117028 being exploited in the wild.

**How severe is CVE-2026-117028?** Informational severity, published 30 October 2026.

**Which products and versions are affected?** Yungifez Skuul through 2.6.5.

**Is there a fix for CVE-2026-117028?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-117028 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-117028?** Check whether you run Yungifez Skuul at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The ResultChecker::checkResult() method in app/Livewire/ResultChecker.php performs insufficient object-level authorization checks. An authenticated student can supply another student's identifier and retrieve that student's examination results because the method only verifies general page-level permission rather than confirming the requester is entitled to view the specific student's data. The vulnerability requires authentication and allows unauthorized read access to sensitive examination records.

## Affected products

- yungifez Skuul through 2.6.5

## Timeline

- 2026-10-30: disclosed

## References

- [https://github.com/dollarboysushil/cve/blob/main/CVE-2026-117028.md](https://github.com/dollarboysushil/cve/blob/main/CVE-2026-117028.md)
- [https://github.com/yungifez/skuul](https://github.com/yungifez/skuul)

## Related threats

- [yungifez Skuul missing authorization in graduation reset](https://junglewise.ai/threats/cve-2026-124502-a-security-vulnerability-has-been-detected-in-yungifez-skuul)
- [yungifez Skuul School Management System sensitive data exposure in image uploads](https://junglewise.ai/threats/cve-2025-13785-yungifez-skuul-school-management-system-sensitive-data-exposure)
- [yungifez Skuul School Management System stored XSS in SVG handler](https://junglewise.ai/threats/cve-2025-13784-yungifez-skuul-school-management-system-stored-xss-in-svg-handler)
- [Skuul School Management System has an Insecure Direct Object Reference (IDOR) Vulnerability in View Fee Invoice](https://junglewise.ai/threats/cve-2025-12918-skuul-school-management-system-has-an-insecure-direct-object)