PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-10168 OUSL-GROUP-BrinaryBrains CVE debrief

A LOW-severity vulnerability (CVSS 4.0: 2.1) in the OUSL-GROUP-BrinaryBrains School Student Management System affects the `marks` function within `application/controllers/Parents.php`. The flaw stems from improper control of resource identifiers (CWE-99) via manipulation of the `param1` argument, permitting remote attackers to access or modify resources without proper authorization. The project uses continuous delivery with rolling releases, so specific affected version numbers are unavailable; the vulnerability is confirmed up to commit `1e70e5ad1125b86dca4ee086eb6bb121f17708b6`. The issue was reported to the project via GitHub but had not received a response as of the CVE publication date. A public exploit has been disclosed and may be actively used. No CPE criteria are currently assigned, and vendor attribution carries low confidence based on reference-domain inference.

Vendor
OUSL-GROUP-BrinaryBrains
Product
School Student Management System
CVSS
LOW 2.1
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-31
Original CVE updated
2026-05-31
Advisory published
2026-05-31
Advisory updated
2026-05-31

Who should care

Organizations running the OUSL-GROUP-BrinaryBrains School Student Management System; security teams monitoring PHP/CodeIgniter applications with rolling-release update models; developers responsible for access control in student information systems

Technical summary

The `marks` function in `application/controllers/Parents.php` fails to properly control access to resource identifiers supplied through the `param1` argument. A remote attacker with low privileges can manipulate this parameter to access or modify resources belonging to other users or contexts. The application uses a rolling-release deployment model without versioned releases, complicating patch tracking. The vulnerability was reported to the project via GitHub issue #25, but maintainers had not responded as of 2026-05-31. A public exploit exists and may be used in the wild.

Defensive priority

P3

Recommended defensive actions

  • Review and restrict access controls on the `marks` endpoint in `application/controllers/Parents.php`
  • Validate and sanitize the `param1` argument against an allowlist of authorized resource identifiers
  • Implement indirect object references or session-bound tokens to prevent direct resource identifier manipulation
  • Monitor application logs for unauthorized access patterns to the `marks` function
  • Apply input validation and output encoding consistent with OWASP Cheat Sheet guidelines
  • Engage with the project maintainers via the reported GitHub issue to coordinate remediation
  • Consider web application firewall (WAF) rules to detect anomalous `param1` payloads pending code fix

Evidence notes

Vulnerability identified in `Parents.php` `marks` function through `param1` argument manipulation. CWE-99 (Improper Control of Resource Identifiers) assigned by VulDB. CVSS 4.0 vector confirms network attack vector with low privileges required and no user interaction. GitHub issue #25 filed but vendor has not responded.

Official resources

Public exploit disclosed; vendor unresponsive to initial report