What is GHSA-r588-8qfc-26mv?

GHSA-r588-8qfc-26mv is a security advisory published by GitHub Security Advisories with Critical severity. openSIS Classic 9.3 allows an authenticated user with the built-in teacher role can select an...

Which CVE IDs does GHSA-r588-8qfc-26mv cover?

GHSA-r588-8qfc-26mv covers the following CVE IDs: CVE-2026-91107. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

GHSA-r588-8qfc-26mvCritical

openSIS Classic 9.3 allows an authenticated user with the built-in teacher role can select an...

Vendor

GitHub Security Advisories

Published

October 6, 2026

Last Modified

October 6, 2026

🔗 CVE IDs covered (1)

CVE-2026-91107 →

📋 Description

openSIS Classic 9.3 allows an authenticated user with the built-in teacher role can select an arbitrary staff record through staff_id and cause the School Information update path to reset that selected account's password.

🔗 References (5)

https://nvd.nist.gov/vuln/detail/CVE-2026-91107
https://github.com/OS4ED/openSIS-Classic/commit/24bb530391a67c114cd4fe3dff65da7e070f5ed1
https://fluidattacks.com/advisories/hearts
https://github.com/OS4ED/openSIS-Classic
https://github.com/advisories/GHSA-r588-8qfc-26mv