CVE-2025-11661 is a high severity missing authentication flaw (CVSS 7.3) in the ProjectsAndPrograms School Management System. An unspecified part of the app can be reached without signing in. The product has no versions, so review access control on every page and check the project.
What's affected
The record lists the ProjectsAndPrograms School Management System, builds up to commit 6b6fae5426044f89c08d0dd101c7fa71f9042a59. The record does not name a file or function for this one. It says only that the manipulation of an unspecified part leads to missing authentication, classed under CWE-287 (Improper Authentication) and CWE-306 (Missing Authentication for Critical Function).
The product does not use versioning and follows a rolling release model, so you need to know your deployed commit. The CVSS vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L: a network attack of low complexity, with no account and no user interaction. The record adds that the exploit has been made public and may be used.
This CVE is part of a group of six from one disclosure, five of which are upload handler flaws in the same project.
How to check if you're exposed
Because the record is vague about the location, the check is a review of access control across the application. Work through each page and handler.
- List every PHP file that a browser can request directly.
- For each, confirm that the code checks for a signed in session before doing any work.
- Test the pages as a signed out user from your own browser on a copy of the app, and note anything that answers with data or accepts a change.
You can speed up step one with a search for files that never check the session:
grep -L "session" $(find /var/www/app -name "*.php") | head -50
Files with no session check are not all flawed, since public pages exist, but each one deserves a look. A dynamic scan of a staging copy is another way to find pages that answer without a login.
What to do now
-
Put the application behind a VPN or an allowlist until you have finished the review.
-
Add one shared authentication check that every non public page includes at the top, so no page can forget it.
-
Deny by default at the web server for admin and asset folders.
-
Check logs for requests to internal paths from signed out clients.
-
Treat the related upload CVEs in this project as part of the same fix.
-
Watch the project page for a newer commit, and re-test after you update.
Why it matters
Missing authentication, tracked as CWE-287 (Improper Authentication) and CWE-306 (Missing Authentication for Critical Function), means the application does not check who is asking before it does something that should be restricted. It is among the simplest flaws to describe and, when it exists, among the easiest to misuse because there is nothing to defeat.
School systems hold records about minors and staff. A rolling release project with no versions, no advisory, and no patch notes makes triage harder, so a short code review by someone who knows web access control is worth the time.
The record does not mark the CVE as exploited in the CISA Known Exploited Vulnerabilities catalog. It does say the exploit is public.
To see whether a vulnerable package is hiding in your own projects, run the free in-browser dependency scan at gold.safeguard.sh/scan. The Gold directory lists the same advisories alongside affected versions, and reachability analysis helps you rank which findings are actually called by your code.
Quick check
Why is no file named in the record?
The record says only that an unspecified part is affected. Review every page that handles data or changes, and do not rely on one file name.
Does fixing the upload files fix this?
Not necessarily. Upload handlers and general access control are separate checks. Fix both.
Sources
Last reviewed: 19 October 2026.
