CVE-2025-11047 - Portabilis i-Educar aluno improper authorization

Back Back to CVE browser

MEDIUM

Portabilis i-Educar aluno improper authorization

Published Sep 26, 2025

5.3

MEDIUM

CVSS 4.0

EPSS 0.38%

Description

A weakness has been identified in Portabilis i-Educar up to 2.10. Affected is an unknown function of the file /module/Api/aluno. This manipulation of the argument aluno_id causes improper authorization. The attack may be initiated remotely. The exploit has been made available to the public and could be exploited.

Affected products

Vendor Portabilis Product i-Educar Default
n/a
- Version
  2.0
  Status
  affected
  Constraints
  -
- Version
  2.1
  Status
  affected
  Constraints
  -
- Version
  2.10
  Status
  affected
  Constraints
  -
- Version
  2.2
  Status
  affected
  Constraints
  -
- Version
  2.3
  Status
  affected
  Constraints
  -
- Version
  2.4
  Status
  affected
  Constraints
  -
- Version
  2.5
  Status
  affected
  Constraints
  -
- Version
  2.6
  Status
  affected
  Constraints
  -
- Version
  2.7
  Status
  affected
  Constraints
  -
- Version
  2.8
  Status
  affected
  Constraints
  -
- Version
  2.9
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Portabilis

i-Educar

n/a

Version	Status	Constraints
2.0	affected	-
2.1	affected	-
2.10	affected	-
2.2	affected	-
2.3	affected	-
2.4	affected	-
2.5	affected	-
2.6	affected	-
2.7	affected	-
2.8	affected	-
2.9	affected	-

Remediation

No remediation recorded yet.

Weaknesses (2)

CWE-266

Incorrect Privilege Assignment

CWE-285

References (5)

https://github.com/marcelomulder/CVE/blob/main/i-educar/Broken_Object_Level_Authorization_allows_enumeration_of_student_records_via_.module.Api.aluno.md
broken-linkexploitBroken Link
https://github.com/marcelomulder/CVE/blob/main/i-educar/CVE-2025-11047.md
exploitrelatedThird Party Advisory
https://vuldb.com/?ctiid.326084
signaturepermissions-requiredPermissions RequiredVDB Entry
https://vuldb.com/?id.326084
vdb-entrytechnical-descriptionThird Party AdvisoryVDB Entry
https://vuldb.com/?submit.659201
exploitthird-party-advisoryThird Party AdvisoryVDB Entry

Link	Providers	Tags
https://github.com/marcelomulder/CVE/blob/main/i-educar/Broken_Object_Level_Authorization_allows_enumeration_of_student_records_via_.module.Api.aluno.md		broken-linkexploitBroken Link
https://github.com/marcelomulder/CVE/blob/main/i-educar/CVE-2025-11047.md		exploitrelatedThird Party Advisory
https://vuldb.com/?ctiid.326084		signaturepermissions-requiredPermissions RequiredVDB Entry
https://vuldb.com/?id.326084		vdb-entrytechnical-descriptionThird Party AdvisoryVDB Entry
https://vuldb.com/?submit.659201		exploitthird-party-advisoryThird Party AdvisoryVDB Entry