Quick answers
- Is CVE-2026-19786 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-19786 being exploited in the wild.
- How severe is CVE-2026-19786?
- Medium severity, with a CVSS score of 4.3, published 14 August 2026.
- Which products and versions are affected?
- Francoisjacquet RosarioSIS up to 12.8.
- Is there a fix for CVE-2026-19786?
- A patch was published on 2026: Version 12.9 includes the patch Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-19786 attacked?
- It is attacked over the network, in a web application.
- Am I affected by CVE-2026-19786?
- Check whether you run Francoisjacquet RosarioSIS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability is a cross-site request forgery (CSRF) flaw affecting the processing of the Modules.php file in RosarioSIS up to version 12.8. The root cause is insufficient CSRF token validation on requests containing the modfunc= parameter in links. An attacker can craft a malicious web page that, when visited by an authenticated school administrator or staff member, causes their browser to execute unintended actions within RosarioSIS without their knowledge. The attack requires the victim to be logged into RosarioSIS and click on a malicious link or visit a crafted page. The vulnerability was patched in version 12.9 (commit 801a71272c82cf4bf695fdc5ed42a9b7511d124d) by removing the modfunc= parameter from links.
Affected products
- francoisjacquet RosarioSIS up to 12.8
Timeline
- 2026-08-14: disclosed
- 2026: patched: Version 12.9 includes the patch