CVE-2025-10072: Portabilis I-educar Auth Bypass Vulnerability

CVE-2025-10072 Overview

CVE-2025-10072 is a broken access control vulnerability in Portabilis i-Educar versions up to 2.10. The flaw affects the /matricula/[ID_STUDENT]/enturmar/ endpoint, which handles student class enrollment operations. An authenticated attacker with low privileges can manipulate the request to perform actions outside their authorization scope. The vulnerability is remotely exploitable over the network and public exploit details are available on GitHub. Portabilis addressed the issue in version 2.11.0, confirming that the previously reported attack vector could no longer be reproduced against the corrected code. The weakness is classified under CWE-266: Incorrect Privilege Assignment.

Critical Impact

Authenticated users can abuse the enrollment endpoint to bypass intended access controls, affecting the confidentiality, integrity, and availability of student enrollment records.

Affected Products

• Portabilis i-Educar versions up to and including 2.10
• Portabilis i-Educar fixed in version 2.11.0
• Deployments exposing the /matricula/[ID_STUDENT]/enturmar/ endpoint to authenticated users

Discovery Timeline

• 2025-09-07 - CVE-2025-10072 published to the National Vulnerability Database (NVD)
• 2026-09-18 - Last updated in NVD database

Technical Details for CVE-2025-10072

Vulnerability Analysis

The vulnerability resides in the student enrollment workflow of Portabilis i-Educar, a Brazilian open-source school management platform. The endpoint /matricula/[ID_STUDENT]/enturmar/ processes requests to assign a student to a class but fails to enforce proper authorization checks on the acting user. An attacker with a low-privileged account can craft requests that manipulate enrollment data belonging to students or classes outside their intended scope. The vendor confirmed the issue after testing the corrected code against the originally reported attack vector. Public technical write-ups documenting the exploitation path are available in the GitHub Access Control Exploit documentation and the VulDB CVE-2025-10072 Report.

Root Cause

The root cause is improper access control [CWE-266] within the request handler for the enrollment endpoint. The application accepts the ID_STUDENT path parameter and processes the enrollment action without validating that the authenticated user has authority over the targeted student record. This design flaw allows horizontal access boundaries to be crossed through parameter manipulation.

Attack Vector

Exploitation requires network access to the i-Educar web interface and a valid low-privileged account. The attacker modifies the ID_STUDENT value in the request URL to reference an unauthorized student record and submits the enrollment manipulation. No user interaction is required beyond the attacker's own session. The vulnerability mechanism and reproduction steps are documented in the public CVE-2025-10072 Details on GitHub. No verified exploitation code examples are included here; refer to the external advisories for implementation specifics.

Detection Methods for CVE-2025-10072

Indicators of Compromise

• Unexpected HTTP requests to /matricula/[ID_STUDENT]/enturmar/ where the authenticated user has no legitimate relationship to the target student record.
• Enrollment or class assignment changes in audit logs that do not match the originating user's administrative scope.
• Repeated enumeration of sequential ID_STUDENT values from a single session within short time windows.

Detection Strategies

• Review i-Educar application logs for enrollment modifications correlated with user accounts lacking the appropriate role permissions for the affected students.
• Deploy web application firewall (WAF) rules to flag high-rate requests against the /matricula/*/enturmar/ path originating from non-administrative accounts.
• Correlate authentication events with enrollment write operations to identify mismatches between user scope and modified records.

Monitoring Recommendations

• Continuously monitor HTTP access logs for the enturmar endpoint and alert on anomalous volumes or unauthorized role combinations.
• Forward web server and database audit logs to a centralized SIEM for retention and cross-source correlation.
• Track changes to the matricula database table and alert on modifications that bypass the application's role-based workflow.

How to Mitigate CVE-2025-10072

Immediate Actions Required

• Upgrade Portabilis i-Educar to version 2.11.0, which contains the vendor-confirmed fix for the broken access control issue.
• Audit existing accounts and recent enrollment changes to identify any unauthorized modifications made before patching.
• Restrict network exposure of the i-Educar application to trusted networks or VPNs while patch deployment is scheduled.

Patch Information

Portabilis released the fix in i-Educar version 2.11.0. The patched release is available in the i-Educar GitHub repository at tag 2.11.0. The vendor explicitly confirmed that the previously described improper access control behavior could no longer be reproduced against the corrected code.

Workarounds

• If immediate upgrade is not feasible, restrict access to the /matricula/*/enturmar/ route to administrative roles at the reverse proxy or WAF layer.
• Review and tighten role-based access control (RBAC) assignments within i-Educar to minimize the number of accounts with enrollment privileges.
• Enable detailed application logging on enrollment endpoints to support rapid detection of exploitation attempts until the patch is applied.

# Example nginx snippet restricting the vulnerable endpoint by source network
location ~ ^/matricula/[0-9]+/enturmar/ {
    allow 10.0.0.0/8;
    deny all;
    proxy_pass http://i_educar_backend;
}