{"schema":"threatline.record/2","record":{"id":"CVE-2026-91107","aliases":[],"summary":"openSIS Classic 9.3 - Insecure Direct Object Reference (IDOR)","details":"openSIS Classic 9.3 allows an authenticated user with the built-in teacher role can select an arbitrary staff record through staff_id and cause the School Information update path to reset that selected account's password.","categories":["Unclassified"],"product":"openSIS-Classic","vendor":"OS4ED","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-91107","source_modified_at":"2026-10-06T13:54:11.351Z","fetched_at":"2026-10-23T18:52:38.922436Z","product":"openSIS-Classic","vendor":"OS4ED","versions":[{"status":"affected","version":"9.3"}],"defaultStatus":"unaffected"}],"fixed_versions":[],"cvss":9.3,"severity":"Critical","kev":{"listed":false},"epss":{"probability":0.00238,"percentile":0.14027,"score_date":"2026-10-23"},"published_at":"2026-10-05T21:29:29.268Z","modified_at":"2026-10-06T13:54:11.351Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-91107","fetched_at":"2026-10-23T18:52:38.922436Z","source_modified_at":"2026-10-06T13:54:11.351Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-91107","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["CVE List","EPSS"],"references":[{"source":"CVE List","url":"https://fluidattacks.com/advisories/hearts","tags":["third-party-advisory"]},{"source":"CVE List","url":"https://github.com/OS4ED/openSIS-Classic","tags":["product"]},{"source":"CVE List","url":"https://github.com/OS4ED/openSIS-Classic/commit/24bb530391a67c114cd4fe3dff65da7e070f5ed1","tags":["patch"]}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","ssvc":{"exploitation":"none","automatable":"no","technical_impact":"total","assessed_at":"2026-10-06T13:53:53.280988Z"},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-06T13:54:11.351Z","content_hash":"6adb0ba02da78e171b9e72241275ed2ffd143402db5ffeedd1be27d9c2087b3d"}}