SZB-c73fd98968
EUVD-2026-113992 reports access control flaw in Skuul School Management System
- Status
- Unverified: only social posts report this so far
- Kind
- Vulnerability
- Vendor
- Skuul
- Product
- School Management System
- First seen
Summary
The EUVD listing, which gives no CVSS score, says Skuul School Management System through version 2.6.5 has incorrect access control in ResultChecker::checkResult. The listing says an authenticated student can read other students' examination results by changing the studentId parameter.
If you use Skuul
Check with the Skuul vendor for a patched version
Upgrade past version 2.6.5 once a fix is released
Audit access logs for requests that change studentId
What the sources say 1
· Mastodon: “Skuul School Management System through version 2.6.5 is vulnerable to incorrect access control in the ResultChecker::checkResult method.” Source