CVE-2026-124502 yungifez Skuul School Management System Delete GraduationController.php resetGraduation authorization
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-124502?
CVE-2026-124502 is a medium-severity vulnerability in yungifez Skuul School Management System, published on 9 Nov 2026.
Official description
A security vulnerability has been detected in yungifez Skuul School Management System up to 2.6.3. Affected by this vulnerability is the function GraduationController::resetGraduation of the file app/Http/Controllers/GraduationController.php of the component Delete Handler. Such manipulation of the argument student leads to missing authorization. The attack can be executed remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 3.0.0 addresses this issue. The name of the patch is b42f2c80a8e5e01ca6e607bbd97f137ede368ac9. The affected component should be upgraded.
Which versions are affected by CVE-2026-124502?
How do I fix CVE-2026-124502?
No fix has been published for CVE-2026-124502 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-124502 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-124502 exists.
Sources
Also known as GHSA-q4wc-r234-m6wv.