CVE-2026-10168: Improper Resource Control in OUSL-GROUP-BrinaryBrains Student Management System

Technical summary

CVE-2026-10168 is a CWE-99 (Improper Control of Resource Identifiers) vulnerability in the marks() function within application/controllers/Parents.php. The vulnerability stems from insufficient validation of the param1 argument, allowing parameter manipulation. An authenticated remote attacker can craft requests that bypass intended access controls on resource identifiers, potentially viewing or modifying records belonging to other students or parents. The system uses continuous delivery with rolling releases, making version tracking difficult. CVSS 3.1 rating is 6.3 (MEDIUM) with vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L, reflecting network accessibility, low attack complexity, and requirement for prior authentication.

Business impact

For school deployments, this vulnerability creates operational and compliance risk. Student grades, attendance, and parental communications—sensitive Personal Identifiable Information (PII)—may be exposed or altered by authenticated attackers. Schools face potential liability under FERPA (Family Educational Rights and Privacy Act) if unauthorized disclosure occurs. Unauthorized modification of academic records could harm student transcripts and institutional records integrity. Reputational damage and loss of parent trust follows public breach disclosure. The continuous delivery model means affected instances may span many deployment points without clear version boundaries, complicating scope assessment.

Affected systems

OUSL-GROUP-BrinaryBrains School Student Management System is affected up to commit 1e70e5ad1125b86dca4ee086eb6bb121f17708b6. Because the product uses continuous delivery with rolling releases, specific version numbers are not available. All active deployments of this system should be considered potentially affected unless patched. The vulnerability requires an authenticated user account (parent, staff, or admin login), so external unauthenticated attacks are not possible. Organizations running this system should audit all instances regardless of purported version.

Exploitability

Public disclosure has occurred, making exploit techniques and payload construction known to threat actors. The attack requires valid credentials (authentication is required per CVSS vector), limiting the immediate attack surface to users with legitimate access—parents, teachers, or administrators. However, credential compromise, insider threats, or shared accounts increase practical exploitability. Attack complexity is low; no special tooling or race conditions are needed. A malicious insider or compromised account holder can trivially exploit by crafting HTTP requests with modified param1 values to access unauthorized records. The lack of vendor response since early notification increases window of exposure.

Remediation

Apply security updates from OUSL-GROUP-BrinaryBrains when released. Because the vendor has not yet responded to early notification and no public patches are available as of the last modification date (2026-06-17), immediate patching is not an option. Implement compensating controls: enforce strong password policies and multi-factor authentication to reduce credential compromise risk; apply principle of least privilege (limit parent accounts to their own records only); audit and restrict database query permissions at the application layer; implement detailed logging of access to student records; conduct a retrospective audit of the marks function to identify unauthorized access. Consider disabling or restricting the marks feature if possible until patches are available. Escalate to the vendor for urgent patch availability and timeline.

Patch guidance

No vendor-released patches are currently available due to the vendor's unresponsive status. Verify the latest release from OUSL-GROUP-BrinaryBrains official repository or advisory channels. Once patches are published, update immediately, prioritizing this as a critical security task given the sensitive nature of educational data. For rolling-release deployments, ensure your continuous integration/deployment pipeline validates security commits and does not automatically pull unverified updates. After patching, re-test the marks function with both authorized and unauthorized user accounts to confirm parameter validation has been implemented.

Detection guidance

Monitor application logs for suspicious parameter patterns in requests to application/controllers/Parents.php (marks function). Look for param1 values that reference student IDs or resources not owned by the authenticated user. Enable detailed HTTP request logging at the web server and application level. Search for sequences of requests where a single parent account accesses or modifies records belonging to multiple students. Database query logging can reveal unauthorized SELECT or UPDATE statements on student records initiated by the Parents module. Implement alerting on repeated 403 (Forbidden) responses followed by successful access to unintended records—a potential sign of parameter enumeration. Review access control logs for any marks modifications outside the expected user's scope.

Why prioritize this

Although CVSS 6.3 is MEDIUM severity, prioritize this issue because: (1) student data is regulated by FERPA and other privacy laws, creating compliance liability; (2) public disclosure increases exploitation likelihood; (3) the vendor is unresponsive, leaving organizations without a clear remediation path; (4) educational institutions are attractive targets for data theft and ransom; (5) the vulnerability affects data integrity (student grades), with long-term consequences for victims. Schools should treat this as HIGH priority internally despite the MEDIUM CVSS score.

Risk score, explained

CVSS 3.1 score of 6.3 reflects the required authentication (PR:L), network-based attack vector (AV:N), and low attack complexity (AC:L). The score assumes a single user session and isolated impact (S:U). However, context elevates practical risk: sensitive PII, regulatory exposure, vendor unresponsiveness, and public disclosure shift the operational risk profile higher than the numeric CVSS suggests. Use CVSS as a technical baseline, not the sole priority driver for educational institutions.

Frequently asked questions