Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.3

openSIS Classic lets teacher reset any staff password

CVE-2026-91107 · published 13 days ago
Summary

In openSIS Classic version 9.3, a teacher who logs in can change the staff_id value in a request and cause the system to reset the password of any staff member. This means an unauthorized person could take over other users’ accounts. Update to the latest version or apply the vendor’s patch to stop the password reset misuse.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
os4ed opensis-classic 9.3
Original advisory text
openSIS Classic 9.3 - Insecure Direct Object Reference (IDOR)
openSIS Classic 9.3 allows an authenticated user with the built-in teacher role can select an arbitrary staff record through staff_id and cause the School Information update path to reset that selected account's password.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker full control
Severity
9.3 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-639Authorization Bypass Through User-Controlled Key
Timeline
Published5 Oct 2026
Updated14 Oct 2026
First seen5 Oct 2026
Sources
CVE-2026-91107 · NVD
CVE-2026-91107 · MITRE
CVE-2026-91107 · OSV
Track software like this
Free during beta