CVE-2026-121732 — RosarioSIS Before 12.9: Improper Authorization in Student Billing Mass Assignment

RosarioSIS versions before 12.9 contain an improper authorization vulnerability that allows school-scoped administrators to assign fees and payments to students from other schools.