CVE-2025-10071
📋 TL;DR
This vulnerability allows attackers to bypass access controls in Portabilis i-Educar's batch enrollment cancellation endpoint. Remote attackers can manipulate the /cancelar-enturmacao-em-lote/ endpoint to perform unauthorized actions. All users of i-Educar up to version 2.10 are affected.
💻 Affected Systems
- Portabilis i-Educar
📦 What is this software?
I Educar by Portabilis
⚠️ Risk & Real-World Impact
Worst Case
Attackers could cancel batch enrollments without authorization, potentially disrupting educational operations and student data integrity.
Likely Case
Unauthorized users could cancel student enrollments they shouldn't have access to, causing administrative disruption.
If Mitigated
With proper access controls, only authorized administrators could perform batch enrollment cancellations.
🎯 Exploit Status
Exploit details are publicly available in GitHub repositories.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Version after 2.10
Vendor Advisory: https://github.com/portabilis/i-educar
Restart Required: No
Instructions:
1. Update i-Educar to version after 2.10. 2. Verify the patch is applied by checking version. 3. Test the /cancelar-enturmacao-em-lote/ endpoint functionality.
🔧 Temporary Workarounds
Endpoint Restriction
allRestrict access to the vulnerable endpoint using web server configuration or firewall rules.
# Apache: <Location /cancelar-enturmacao-em-lote/> Require valid-user </Location>
# Nginx: location /cancelar-enturmacao-em-lote/ { deny all; }
🧯 If You Can't Patch
- Implement strict access controls and authentication for the endpoint.
- Monitor and log all access attempts to the vulnerable endpoint.
🔍 How to Verify
Check if Vulnerable:
Check if i-Educar version is 2.10 or earlier and the /cancelar-enturmacao-em-lote/ endpoint is accessible.Check Version:
Check i-Educar configuration files or admin panel for version information.Verify Fix Applied:
Verify i-Educar version is after 2.10 and test endpoint access controls.📡 Detection & Monitoring
Log Indicators:
- Unauthorized access attempts to /cancelar-enturmacao-em-lote/
- Multiple enrollment cancellation requests from single user
Network Indicators:
- HTTP requests to /cancelar-enturmacao-em-lote/ without proper authentication
SIEM Query:
source="web_server" AND uri="/cancelar-enturmacao-em-lote/" AND (user="anonymous" OR auth_status="failed")🔗 References
- https://github.com/marcelomulder/CVE/blob/main/i-educar/Broken%20Access%20Control%20Vulnerability%20%20in%20%60.cancelar-enturmacao-em-lote.(ID)%60%20Endpoint.md
- https://github.com/marcelomulder/CVE/blob/main/i-educar/CVE-2025-10071.md
- https://vuldb.com/?ctiid.323019
- https://vuldb.com/?id.323019
- https://vuldb.com/?submit.644134
