PT-2026-36600 · Zyosoft · School App

Published 2026-05-02 · Updated 2026-05-02 · CVE-2026-7491

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions School App developed by Zyosoft (affected versions not specified)

Description An Insecure Direct Object Reference (IDOR) issue exists, where authenticated remote attackers can modify a specific parameter to read and modify data belonging to other users. IDOR is a type of access control flaw that occurs when an application uses user-supplied input to access objects directly.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2026-7491

Affected Products

School App

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2026-7491 · Security Note
• https://twitter.com/CVEnew/status/2050523102640058468 · Twitter Post
• https://twcert.org.tw/en/cp-139-10897-64257-2.html · Note
• https://twcert.org.tw/tw/cp-132-10896-e3240-1.html · Note
• https://twitter.com/infoflowcloud/status/2050524591597015537 · Twitter Post