PatchSiren cyber security CVE debrief
CVE-2026-10168 OUSL-GROUP-BrinaryBrains CVE debrief
A LOW-severity vulnerability (CVSS 4.0: 2.1) in the OUSL-GROUP-BrinaryBrains School Student Management System affects the `marks` function within `application/controllers/Parents.php`. The flaw stems from improper control of resource identifiers (CWE-99) via manipulation of the `param1` argument, permitting remote attackers to access or modify resources without proper authorization. The project uses continuous delivery with rolling releases, so specific affected version numbers are unavailable; the vulnerability is confirmed up to commit `1e70e5ad1125b86dca4ee086eb6bb121f17708b6`. The issue was reported to the project via GitHub but had not received a response as of the CVE publication date. A public exploit has been disclosed and may be actively used. No CPE criteria are currently assigned, and vendor attribution carries low confidence based on reference-domain inference.
- Vendor
- OUSL-GROUP-BrinaryBrains
- Product
- School Student Management System
- CVSS
- LOW 2.1
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2026-05-31
- Original CVE updated
- 2026-05-31
- Advisory published
- 2026-05-31
- Advisory updated
- 2026-05-31
Who should care
Organizations running the OUSL-GROUP-BrinaryBrains School Student Management System; security teams monitoring PHP/CodeIgniter applications with rolling-release update models; developers responsible for access control in student information systems
Technical summary
The `marks` function in `application/controllers/Parents.php` fails to properly control access to resource identifiers supplied through the `param1` argument. A remote attacker with low privileges can manipulate this parameter to access or modify resources belonging to other users or contexts. The application uses a rolling-release deployment model without versioned releases, complicating patch tracking. The vulnerability was reported to the project via GitHub issue #25, but maintainers had not responded as of 2026-05-31. A public exploit exists and may be used in the wild.
Defensive priority
P3
Recommended defensive actions
- Review and restrict access controls on the `marks` endpoint in `application/controllers/Parents.php`
- Validate and sanitize the `param1` argument against an allowlist of authorized resource identifiers
- Implement indirect object references or session-bound tokens to prevent direct resource identifier manipulation
- Monitor application logs for unauthorized access patterns to the `marks` function
- Apply input validation and output encoding consistent with OWASP Cheat Sheet guidelines
- Engage with the project maintainers via the reported GitHub issue to coordinate remediation
- Consider web application firewall (WAF) rules to detect anomalous `param1` payloads pending code fix
Evidence notes
Vulnerability identified in `Parents.php` `marks` function through `param1` argument manipulation. CWE-99 (Improper Control of Resource Identifiers) assigned by VulDB. CVSS 4.0 vector confirms network attack vector with low privileges required and no user interaction. GitHub issue #25 filed but vendor has not responded.
Official resources
Public exploit disclosed; vendor unresponsive to initial report