CVE-2026-2015 | Portabilis i-Educar up to 2.10 Final Status Import FinalStatusImportService.php school_id improper authorization

A vulnerability classified as critical was found in Portabilis i-Educar up to 2.10. Affected is an unknown function of the file FinalStatusImportService.php of the component Final Status Import. Executing a manipulation of the argument school_id can lead to improper authorization.

This vulnerability is handled as CVE-2026-2015. The attack can be executed remotely. Additionally, an exploit exists.

The vendor was contacted early about this disclosure but did not respond in any way.