CVE-2026-91107

openSIS Classic 9.3 - Insecure Direct Object Reference (IDOR)

State: Published
Severity: 9.3 Critical
Published: Oct 5, 2026
Updated: Oct 6, 2026
Reserved: Sep 14, 2026

Description

openSIS Classic 9.3 allows an authenticated user with the built-in teacher role can select an arbitrary staff record through staff_id and cause the School Information update path to reset that selected account's password.

Scores

CVSS	Score	Vector	Source
4.0	9.3 Critical	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N	Fluid Attacks

Weaknesses

CWE-639 Authorization Bypass Through User-Controlled Key

Affected Products

Product	Versions
openSIS-ClassicOS4ED	9.3Affected

References

https://fluidattacks.com/advisories/heartsthird-party-advisory
https://github.com/OS4ED/openSIS-Classicproduct
https://github.com/OS4ED/openSIS-Classic/commit/24bb530391a67c114cd4fe3dff65da7e070f5ed1patch

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.