CVE-2026-19786CWE-352CWE-862broken-access-controlcsrf

CVE-2026-19786

Medium · published August 14, 2026

CVSS v3.1
4.3
EPSS
0%
Percentile
14.3
In the wild
Unconfirmed
What it is

A vulnerability was found in francoisjacquet RosarioSIS up to 12.8. This issue affects some unknown processing of the file Modules.php. Performing a manipulation results in cross-site request forgery. Remote exploitation of the attack is possible. Upgrading to version 12.9 is capable of addressing this issue. The patch is named 801a71272c82cf4bf695fdc5ed42a9b7511d124d. It is recommended to upgrade the affected component.

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
CVSS v4.0
5.3 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X
EPSS
0.00241 · 14.3th percentile
Weaknesses
CWE-352 · Cross-Site Request Forgery (CSRF); CWE-862 · Missing Authorization
Published
2026-08-14T07:16Z
References (9)
https://github.com/francoisjacquet/RosarioSIS/commit/801a71272c82cf4bf695fdc5ed42a9b7511d124d · [email protected]https://github.com/francoisjacquet/rosariosis/ · [email protected]https://github.com/francoisjacquet/rosariosis/issues/302 · [email protected]https://github.com/francoisjacquet/rosariosis/releases/tag/v12.9 · [email protected]https://vuldb.com/cve/CVE-2026-19786 · [email protected]https://vuldb.com/submit/869378 · [email protected]https://vuldb.com/vuln/389746 · [email protected]https://vuldb.com/vuln/389746/cti · [email protected]https://github.com/francoisjacquet/rosariosis/issues/302 · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 14 AUG 02:30Z
    francoisjacquet RosarioSIS Modules.php cross-site request forgery
    cvelistv5