PT-2026-6716 · Unknown · Portabilis I-Educar

Vini_Castro · Published 2026-02-06 · Updated 2026-02-06 · CVE-2026-2015

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Portabilis i-Educar versions up to 2.10

Description A weakness exists in Portabilis i-Educar up to version 2.10, specifically within the Final Status Import component. The issue involves improper authorization that can be triggered by manipulating the school id argument within an unknown function of the FinalStatusImportService.php file. This manipulation can be executed remotely. The exploit for this issue has been publicly released. The vendor was notified but did not respond.

Recommendations Versions prior to 2.10 should be updated. As a temporary workaround, consider restricting access to the FinalStatusImportService.php file to minimize the risk of exploitation.

Exploit

Fix

Improper Authorization

Incorrect Privilege Assignment

Weakness Enumeration

CWE-285

CWE-266

Related Identifiers

CVE-2026-2015

Affected Products

Portabilis I-Educar

References · 11

• 🔥 https://github.com/ViniCastro2001/Security_Reports/tree/main/i-educar/BFLA-Final-Status-Import · Exploit
• 🔥 https://github.com/ViniCastro2001/Security_Reports/tree/main/i-educar/BFLA-Final-Status-Import#proof-of-concept-poc · Exploit
• https://osv.dev/vulnerability/CVE-2026-2015 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-2015 · Security Note
• https://t.me/CVEtracker/43933 · Telegram Post
• https://vuldb.com/?ctiid.344597 · Note
• https://vuldb.com/?submit.743760 · Note
• https://t.me/cveNotify/151117 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2019815516056015310 · Twitter Post
• https://twitter.com/CVEnew/status/2019728318161883171 · Twitter Post
• https://vuldb.com/?id.344597 · Note