PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-10168 OUSL-GROUP-BrinaryBrains CVE debrief

A LOW-severity vulnerability (CVSS 4.0: 2.1) in the OUSL-GROUP-BrinaryBrains School Student Management System affects the `marks` function within `application/controllers/Parents.php`. The flaw stems from improper control of resource identifiers (CWE-99) via manipulation of the `param1` argument, permitting remote attackers to access or modify resources without proper authorization. The project uses continuous delivery with rolling releases, so specific affected version numbers are unavailable; the vulnerability is confirmed up to commit `1e70e5ad1125b86dca4ee086eb6bb121f17708b6`. The issue was reported to the project via GitHub but had not received a response as of the CVE publication date. A public exploit has been disclosed and may be actively used. No CPE criteria are currently assigned, and vendor attribution carries low confidence based on reference-domain inference.

Vendor
OUSL-GROUP-BrinaryBrains
Product
School Student Management System
CVSS
LOW 2.1
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-31
Original CVE updated
2026-07-22
Advisory published
2026-05-31
Advisory updated
2026-07-22

Who should care

Organizations running the OUSL-GROUP-BrinaryBrains School Student Management System; security teams monitoring PHP/CodeIgniter applications with rolling-release update models; developers responsible for access control in student information systems

Technical summary

The `marks` function in `application/controllers/Parents.php` fails to properly control access to resource identifiers supplied through the `param1` argument. A remote attacker with low privileges can manipulate this parameter to access or modify resources belonging to other users or contexts. The application uses a rolling-release deployment model without versioned releases, complicating patch tracking. The vulnerability was reported to the project via GitHub issue #25, but maintainers had not responded as of 2026-05-31. A public exploit exists and may be used in the wild.

Defensive priority

P3

Recommended defensive actions

  • Review and restrict access controls on the `marks` endpoint in `application/controllers/Parents.php`
  • Validate and sanitize the `param1` argument against an allowlist of authorized resource identifiers
  • Implement indirect object references or session-bound tokens to prevent direct resource identifier manipulation
  • Monitor application logs for unauthorized access patterns to the `marks` function
  • Apply input validation and output encoding consistent with OWASP Cheat Sheet guidelines
  • Engage with the project maintainers via the reported GitHub issue to coordinate remediation
  • Consider web application firewall (WAF) rules to detect anomalous `param1` payloads pending code fix

Evidence notes

Vulnerability identified in `Parents.php` `marks` function through `param1` argument manipulation. CWE-99 (Improper Control of Resource Identifiers) assigned by VulDB. CVSS 4.0 vector confirms network attack vector with low privileges required and no user interaction. GitHub issue #25 filed but vendor has not responded.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-10168 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-10168

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-10168 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-10168

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.