CVE-2025-9609: Portabilis i-Educar Auth Bypass Flaw

CVE-2025-9609 Overview

CVE-2025-9609 is a broken access control vulnerability in Portabilis i-Educar versions up to 2.10. The flaw affects the /educacenso/consulta endpoint, where missing function-level access control allows authenticated low-privilege users to reach functionality reserved for higher-privileged roles [CWE-266]. The vulnerability is exploitable remotely over the network and requires only valid low-privilege credentials. A public proof-of-concept has been published, lowering the barrier to exploitation. Portabilis i-Educar is an open-source school management system used by Brazilian public education networks, making sensitive student and administrative data the primary exposure.

Critical Impact
Authenticated attackers with low privileges can access the /educacenso/consulta endpoint and view data intended only for authorized roles, exposing confidentiality, integrity, and availability of school census data.

Affected Products

Portabilis i-Educar versions up to and including 2.10
Web-facing instances exposing the /educacenso/consulta route
Deployments without compensating reverse-proxy authorization controls

Discovery Timeline

2025-08-29 - CVE-2025-9609 published to NVD
2026-04-29 - Last updated in NVD database

Technical Details for CVE-2025-9609

Vulnerability Analysis

The vulnerability stems from missing function-level access control on the /educacenso/consulta endpoint within i-Educar. The application authenticates users but does not verify whether the requesting account holds the role required to query Educacenso (Brazilian school census) data. Any authenticated user can issue HTTP requests to this route and retrieve information that should be restricted to administrative staff.

This class of flaw is classified under CWE-266 (Incorrect Privilege Assignment). The root issue is an authorization gap, not an authentication failure, which means standard login defenses do not prevent exploitation. Because the endpoint handles census consultation, exposed data can include student records and school identifiers used for federal reporting.

Root Cause

The /educacenso/consulta handler lacks server-side role validation. Access control checks are either absent or rely on client-side UI restrictions that attackers can bypass by directly requesting the URL. The application trusts the session as proof of authorization rather than enforcing per-function permission checks.

Attack Vector

An attacker authenticates to i-Educar using any valid low-privilege account, then sends an HTTP GET request to /educacenso/consulta. The server returns the protected resource without verifying role membership. The attack requires no user interaction and can be executed remotely. A public proof-of-concept is hosted on the researcher's GitHub PoC Repository.

No exploitation code is reproduced here. Refer to the CVE-2025-9609 advisory for the documented request sequence.

Detection Methods for CVE-2025-9609

Indicators of Compromise

HTTP requests to /educacenso/consulta originating from user sessions that do not belong to administrative roles
Unusual volume of GET requests against Educacenso endpoints from a single authenticated session
Application logs showing successful 200 responses on /educacenso/consulta for non-privileged user IDs

Detection Strategies

Correlate web server access logs with i-Educar user role assignments to flag access by accounts without Educacenso permissions
Deploy a web application firewall rule that inspects the session role claim against the requested route
Review database query logs for census data reads tied to unexpected user identifiers

Monitoring Recommendations

Forward i-Educar application and web server logs to a centralized SIEM for role-versus-route correlation
Establish a baseline of legitimate users accessing /educacenso/consulta and alert on deviations
Monitor for newly created low-privilege accounts followed by access attempts to administrative routes

How to Mitigate CVE-2025-9609

Immediate Actions Required

Restrict network access to /educacenso/consulta using reverse-proxy or WAF rules until a patched release is deployed
Audit all i-Educar user accounts and disable any unused or unnecessary low-privilege accounts
Review historical access logs for the affected endpoint to identify prior unauthorized access

Patch Information

No vendor advisory URL is listed in the CVE record at the time of publication. Monitor the Portabilis i-Educar GitHub repository for releases beyond version 2.10 that introduce function-level authorization checks on the Educacenso routes. Track the VulDB entry #321787 for vendor response updates.

Workarounds

Block external access to /educacenso/consulta at the reverse proxy and permit only administrative IP ranges
Enforce role-based authorization at the proxy layer by inspecting session cookies against an allowlist of administrative users
Apply the principle of least privilege to all i-Educar accounts and segregate administrative functions to dedicated accounts

bash

# Example nginx restriction limiting the endpoint to an internal admin subnet
location /educacenso/consulta {
    allow 10.0.10.0/24;   # administrative subnet
    deny all;
    proxy_pass http://i-educar-backend;
}