CVE-2026-117028 in Skuul School Management System
Summary
by MITRE • 10/30/2026
Skuul School Management System through version 2.6.5 is vulnerable to incorrect access control in the ResultChecker::checkResult method. An authenticated student can manipulate the studentId parameter to retrieve another student's examination results, including examination marks, without authorization.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/30/2026
The vulnerability identified within Skuul School Management System versions up to 2.6.5 represents a critical failure in server-side access control mechanisms, specifically located within the ResultChecker::checkResult method. This flaw allows an authenticated user with the role of student to bypass intended security restrictions by manipulating input parameters. In typical web application architectures, authentication verifies who the user is, while authorization determines what resources that specific user is permitted to access. Here, the system correctly authenticates the user but fails to enforce proper authorization checks when retrieving sensitive academic data. The core technical flaw lies in the reliance on client-supplied or easily modifiable input for determining resource ownership. Specifically, the studentId parameter used to fetch examination results is not validated against the identity of the currently authenticated session. This indicates a lack of server-side validation that ensures the requesting user owns the requested record, leading directly to insecure direct object references where internal implementation objects are exposed via user-supplied input without adequate access control checks.
From an operational perspective, this vulnerability enables unauthorized data disclosure affecting the confidentiality and integrity of student records. An attacker can systematically iterate through sequential or predictable student identifiers to harvest examination marks for peers, faculty members if their IDs follow similar patterns, or any other entity within the database schema accessible via that endpoint. The impact extends beyond mere privacy violations; it compromises the academic integrity of the institution by allowing students to view grades they are not authorized to see, which could facilitate cheating or social engineering attacks against staff and administration. Furthermore, such exposure can lead to reputational damage for the educational provider and potential legal consequences under data protection regulations like GDPR or FERPA if personally identifiable information is coupled with academic performance metrics in a manner that violates student privacy rights.
This vulnerability aligns closely with CWE-284 Improper Access Control, as it involves failing to restrict unauthorized access to specific resources based on user roles or ownership. It also maps directly to the OWASP Top 10 category of Insecure Direct Object References (IDOR), where internal object identifiers are exposed and manipulated by attackers to gain unauthorized access. Within the MITRE ATT&CK framework, this behavior corresponds to T1539 Steal Web Session Cookie if session hijacking is involved in gaining initial authentication, but more accurately reflects data exfiltration techniques such as T1005 Data from Local System or specific application-layer exploitation patterns where sensitive information is retrieved through parameter manipulation. The attack vector requires low complexity and minimal prerequisites since the user only needs valid credentials for a student account, making it highly exploitable by insider threats or compromised accounts.
Mitigation strategies must focus on implementing robust server-side authorization checks that decouple resource identification from user input reliance. Developers should ensure that every request to access sensitive data verifies that the authenticated user's identity matches the owner of the requested record. This can be achieved by storing the legitimate student ID in the secure session object and using this value exclusively for database queries, ignoring any studentId parameter provided by the client. Additionally, implementing indirect reference maps where internal IDs are replaced with random, non-sequential tokens can prevent enumeration attacks that rely on guessing valid identifiers. Regular security testing including automated static analysis to detect missing access control checks and dynamic penetration testing to validate authorization logic is essential. Input validation should also be enforced to ensure parameters conform to expected formats, although this alone does not solve the underlying authorization flaw. Updating to a patched version of Skuul School Management System that addresses these access control deficiencies is the immediate remediation step for affected institutions.