CVE-2025-11554 - Portabilis i-Educar User Type AccessLevelController.php insecure inherited permissions

Back Back to CVE browser

MEDIUM

Portabilis i-Educar User Type AccessLevelController.php insecure inherited permissions

Published Oct 9, 2025

5.3

MEDIUM

CVSS 4.0

EPSS 0.38%

Description

A security vulnerability has been detected in Portabilis i-Educar up to 2.9.10. Affected by this issue is some unknown functionality of the file app/Http/Controllers/AccessLevelController.php of the component User Type Handler. The manipulation leads to insecure inherited permissions. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used.

Affected products

Vendor Portabilis Product i-Educar Default
n/a
- Version
  2.9.0
  Status
  affected
  Constraints
  -
- Version
  2.9.1
  Status
  affected
  Constraints
  -
- Version
  2.9.10
  Status
  affected
  Constraints
  -
- Version
  2.9.2
  Status
  affected
  Constraints
  -
- Version
  2.9.3
  Status
  affected
  Constraints
  -
- Version
  2.9.4
  Status
  affected
  Constraints
  -
- Version
  2.9.5
  Status
  affected
  Constraints
  -
- Version
  2.9.6
  Status
  affected
  Constraints
  -
- Version
  2.9.7
  Status
  affected
  Constraints
  -
- Version
  2.9.8
  Status
  affected
  Constraints
  -
- Version
  2.9.9
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Portabilis

i-Educar

n/a

Version	Status	Constraints
2.9.0	affected	-
2.9.1	affected	-
2.9.10	affected	-
2.9.2	affected	-
2.9.3	affected	-
2.9.4	affected	-
2.9.5	affected	-
2.9.6	affected	-
2.9.7	affected	-
2.9.8	affected	-
2.9.9	affected	-

Remediation

No remediation recorded yet.

Weaknesses (2)

CWE-266

Incorrect Privilege Assignment

CWE-277

References (5)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-33561
Advisory
https://github.com/m3m0o/portabilis-ieducar-user-type-privilege-escalation
exploitThird Party Advisory
https://vuldb.com/?ctiid.327714
signaturepermissions-requiredPermissions RequiredVDB Entry
https://vuldb.com/?id.327714
vdb-entrytechnical-descriptionThird Party AdvisoryVDB Entry
https://vuldb.com/?submit.671072
third-party-advisoryThird Party AdvisoryVDB Entry

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-33561		Advisory
https://github.com/m3m0o/portabilis-ieducar-user-type-privilege-escalation		exploitThird Party Advisory
https://vuldb.com/?ctiid.327714		signaturepermissions-requiredPermissions RequiredVDB Entry
https://vuldb.com/?id.327714		vdb-entrytechnical-descriptionThird Party AdvisoryVDB Entry
https://vuldb.com/?submit.671072		third-party-advisoryThird Party AdvisoryVDB Entry