openSIS Classic: Insecure direct object reference allows admin password reset
Summary
openSIS Classic 9.3 contains an insecure direct object reference (IDOR, CWE-639) in the School Information update path. An authenticated user with the built-in teacher role can select an arbitrary staff record through the staff_id parameter and reset that account's password. Because the target can be an administrator account, the attacker can log in as that administrator and access administrator-only functions and data. No victim interaction is required.
Affected
- openSIS Classic 9.3 (OS4ED openSIS-Classic)
- Default permissions for the teacher role are sufficient for the attack.
Fixed in
- The vendor reports a fix; upgrade to the latest openSIS Classic release.
- The exact fixed version is not stated in the sources. Check the commit 24bb530391a67c114cd4fe3dff65da7e070f5ed1 for details.
Workaround
Unknown.
Exploitation
- A public proof of concept is available (Fluid Attacks advisory).
- CISA SSVC: exploitation none, automatable no, technical impact total.
- Attack requires a valid teacher account.
Our recommendation
- Update openSIS Classic to the latest release without delay.
- Review teacher accounts and remove unneeded ones; check for unexpected password changes on administrator accounts.
- Restrict the teacher role's permissions for staff information and remove edit rights where not required.
- Monitor logs for requests to the staff update module from teacher sessions.
- Ensure the PHP installation on the server is also updated, as stated in the vendor's PHP security notice.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Fluid Attacks advisory CVE-2026-91107 fluidattacks.com
- OS4ED openSIS-Classic repository github.com
- Fix commit 24bb530391a67c114cd4fe3dff65da7e070f5ed1 github.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 03:24.
Original description (NVD)
openSIS Classic 9.3 allows an authenticated user with the built-in teacher role can select an arbitrary staff record through staff_id and cause the School Information update path to reset that selected account's password.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.