Is CVE-2026-8207 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-8207 being exploited in the wild.

How severe is CVE-2026-8207?

Informational severity, with a CVSS score of 7, published 9 May 2026.

Which products and versions are affected?

GibbonEdu Gibbon before v30.0.01.

Is there a fix for CVE-2026-8207?

A patch was published on 2026-02-06: Version v30.0.01 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-8207 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-8207?

Check whether you run GibbonEdu Gibbon at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-8207: Gibbon SQL injection in Tracking graphing module

CVE-2026-8207 · Severity: info · CVSS 7 · Published 2026-05-09

Gibbon, an open-source school management platform, contains a security vulnerability in its tracking and graphing module. An attacker with teacher-level access or higher can manipulate database queries to read or modify sensitive school data. This could lead to unauthorized access to student records or the alteration of academic information.

Technologies: GibbonEdu Gibbon. Vendors: GibbonEdu.

Quick answers

Is CVE-2026-8207 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-8207 being exploited in the wild.
How severe is CVE-2026-8207?: Informational severity, with a CVSS score of 7, published 9 May 2026.
Which products and versions are affected?: GibbonEdu Gibbon before v30.0.01.
Is there a fix for CVE-2026-8207?: A patch was published on 2026-02-06: Version v30.0.01 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-8207 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-8207?: Check whether you run GibbonEdu Gibbon at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An authenticated SQL injection vulnerability exists in Gibbon versions prior to v30.0.01 within the `modules/Tracking/graphing.php` component. The root cause is the improper neutralization of user-supplied input in the `gibbonDepartmentIDs` and `gibbonPersonIDs` POST parameters, which are concatenated into SQL queries. An attacker with 'Teacher' or higher privileges can exploit this to execute arbitrary SQL commands, leading to unauthorized data exfiltration or modification. The vendor has released version v30.0.01 to address this issue by improving input validation and parameterization.

Affected products

GibbonEdu Gibbon before v30.0.01

Timeline

2026-02-06: patched: Version v30.0.01 released
2026-05-07: disclosed: Detailed research blog published by Project Black
2026-05-09: advisory: CVE-2026-8207 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.