Portabilis CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

LOW Portabilis CVE published 2026-02-06

CVE-2026-2015

A weakness in Portabilis i-Educar up to 2.10 allows for improper authorization when manipulating the school_id argument in the FinalStatusImportService.php file. This issue can be exploited remotely and a public exploit is available. Upgrading to version 2.11.0 addresses this issue. The vulnerability was reported and tested against the corrected code, and the previously described behavior could no longer [truncated]