Is CVE-2026-19784 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-19784 being exploited in the wild.

How severe is CVE-2026-19784?

Medium severity, with a CVSS score of 4.3, published 14 August 2026.

Which products and versions are affected?

Francoisjacquet RosarioSIS up to 12.8.

Is there a fix for CVE-2026-19784?

A patch was published on 2026-04-27. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-19784 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-19784?

Check whether you run Francoisjacquet RosarioSIS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-19784: francoisjacquet RosarioSIS IDOR in save/delete operations

CVE-2026-19784 · Severity: medium · CVSS 4.3 · Published 2026-08-14

RosarioSIS is a student information system used by schools to manage discipline referrals, billing, and grades. This vulnerability allows authenticated users with certain permissions to modify or delete records belonging to other students, teachers, or schools by directly manipulating record IDs. An attacker could change discipline referrals, delete student billing records, or modify grades without proper authorization checks.

Technologies: Francoisjacquet RosarioSIS. Vendors: Francoisjacquet.

Quick answers

Is CVE-2026-19784 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-19784 being exploited in the wild.
How severe is CVE-2026-19784?: Medium severity, with a CVSS score of 4.3, published 14 August 2026.
Which products and versions are affected?: Francoisjacquet RosarioSIS up to 12.8.
Is there a fix for CVE-2026-19784?: A patch was published on 2026-04-27. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-19784 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-19784?: Check whether you run Francoisjacquet RosarioSIS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

This is an Insecure Direct Object Reference (IDOR) vulnerability affecting multiple modules: Discipline/Referrals.php, Student_Billing/StudentFees.php, StudentPayments.php, and Grades/Assignments-new.php. The root cause is that view/list operations correctly scope data by school, student, and course period, but save/delete operations use only the record ID in their WHERE clauses without verifying the requesting user has access to the affected record. For example, Discipline/Referrals.php delete operations omit school year and school ID checks present in view operations. The vulnerability is remotely exploitable by any authenticated user with edit permissions in the affected modules. Attack preconditions require valid authentication and appropriate role-based access to the vulnerable functions. Upgrading to version 12.9 or applying patch 04dd1a368ddf80ad7082baefa3c656e4e1825c76 resolves the issue by adding proper scope verification to DELETE and UPDATE queries.

Affected products

francoisjacquet RosarioSIS up to 12.8

Timeline

2026-03-01: disclosed
2026-04-27: patched
2026-08-14: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.