CVE-2025-10071: Portabilis I-educar Auth Bypass Vulnerability

CVE-2025-10071 Overview

CVE-2025-10071 is a broken access control vulnerability affecting Portabilis i-Educar versions up to 2.10. The flaw resides in the /cancelar-enturmacao-em-lote/ endpoint, which fails to enforce proper authorization checks on authenticated requests. Remote attackers with low-level credentials can manipulate the endpoint to perform actions they should not be authorized to execute. The weakness is classified under CWE-266: Incorrect Privilege Assignment. Technical details and a proof of concept have been publicly disclosed, making exploitation accessible to a wide range of actors. i-Educar is a widely deployed open-source school management platform used by Brazilian public education institutions.

Critical Impact

Authenticated remote attackers can bypass access controls on the batch class cancellation endpoint to modify student enrollment data they should not control.

Affected Products

• Portabilis i-Educar versions up to and including 2.10
• Deployments exposing the /cancelar-enturmacao-em-lote/ endpoint
• Instances relying solely on authentication without endpoint-level authorization

Discovery Timeline

• 2025-09-07 - CVE-2025-10071 published to NVD
• 2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-10071

Vulnerability Analysis

The vulnerability is a broken access control weakness in the batch class cancellation feature (cancelar-enturmacao-em-lote) of Portabilis i-Educar. The endpoint accepts requests from authenticated users but does not validate whether the acting user holds the role or permissions required to cancel enrollments for the targeted records. This allows a low-privileged authenticated attacker to invoke an administrative-style operation that modifies student enrollment state. The impact is limited to the application's data integrity and confidentiality boundaries within the school management workflow.

Root Cause

The root cause is missing or incomplete authorization enforcement on the server-side handler for /cancelar-enturmacao-em-lote/. The application treats authentication as sufficient and does not verify role, scope, or ownership before processing the cancellation request. This design pattern is consistent with CWE-266, where privileges are assigned incorrectly to actors who should not possess them.

Attack Vector

Exploitation requires network access to the i-Educar web interface and valid low-privilege credentials. The attacker sends a crafted HTTP request to the vulnerable endpoint, referencing a target identifier. Because the backend does not enforce authorization, the operation completes as if issued by a privileged user. Public disclosure of the technique is available in the GitHub vulnerability analysis by marcelomulder and the VulDB entry #323019.

No verified exploit code is reproduced here. Refer to the referenced advisories for request-level technical detail.

Detection Methods for CVE-2025-10071

Indicators of Compromise

• HTTP requests to /cancelar-enturmacao-em-lote/ originating from user accounts that do not hold administrative or coordinator roles.
• Unexpected bulk cancellations of student enrollments (enturmacao) in i-Educar audit logs.
• Repeated requests to the endpoint iterating through sequential record identifiers, suggesting enumeration.

Detection Strategies

• Review web server access logs for POST or GET activity targeting /cancelar-enturmacao-em-lote/ and correlate with the authenticated session's assigned role.
• Enable application-level audit logging in i-Educar and alert on enrollment cancellation events performed by non-privileged accounts.
• Deploy a web application firewall rule that logs or blocks access to the endpoint when the session role does not match an approved allowlist.

Monitoring Recommendations

• Centralize i-Educar application and reverse-proxy logs into a SIEM for correlation of user role, source IP, and endpoint access.
• Baseline normal usage of batch enrollment operations and alert on volume anomalies.
• Track authentication events for low-privileged accounts that subsequently access administrative endpoints.

How to Mitigate CVE-2025-10071

Immediate Actions Required

• Restrict network access to the i-Educar administrative interface to trusted internal networks or VPN users.
• Audit all user accounts and remove or downgrade accounts that do not require active access.
• Review enrollment records for unauthorized cancellations performed since the deployment of version 2.10 or earlier.

Patch Information

At the time of the NVD last-modified date (2026-06-17), no vendor advisory URL is listed in the CVE record. Administrators should monitor the Portabilis i-Educar GitHub repository for a fixed release above version 2.10 and apply it as soon as available. Until a patch is available, apply the workarounds below.

Workarounds

• Implement a reverse-proxy rule that requires an administrative role claim before forwarding requests to /cancelar-enturmacao-em-lote/.
• Temporarily disable the batch cancellation route in the application's URL routing configuration if the feature is not operationally required.
• Enforce the principle of least privilege by auditing user roles and removing cancellation permissions from accounts that do not require them.

# Example nginx rule to block the vulnerable endpoint pending patch
location ~* ^/cancelar-enturmacao-em-lote/ {
    deny all;
    return 403;
}