CVE-2026-7491: Zyosoft School App

High severity, CVSS 8.1. EPSS: 0.4% chance of exploitation in the next 30 days.

School App developed by Zyosoft has an Insecure Direct Object Reference vulnerability, allowing authenticated remote attackers to modify a specific parameter to read and modify other users' data.

Affected products

• Zyosoft School App: before 1.1.62 (fixed in 1.1.62); before 2.7.2 (fixed in 2.7.2)

Published 2026-05-02. Last modified 2026-06-17.