An authorization bypass vulnerability in the Zyosoft School App allows authenticated remote attackers to compromise user data confidentiality and integrity.

This is an Insecure Direct Object Reference vulnerability mapped to CWE-639, involving authorization bypass through a user-controlled key, requiring low-level attacker authentication via the network vector.

The exploitation of this vulnerability can result in widespread data exposure and unauthorized modification of sensitive user records across the application. With a CVSS score of 8.1 categorized as high severity, successful attacks undermine data privacy, potentially lead to regulatory non-compliance fines, and erode customer trust.

Immediate Action: Update the Android version of School App to 1.1.62 or later, and the iOS version to 2.7.2 or later.

Proactive Monitoring: Review application access logs for unusual patterns of parameter manipulation associated with object retrieval and updates.

Compensating Controls: Implement strict server-side authorization checks and validation controls on API endpoints to verify that the requesting user owns the requested object.

Public Exploit Available: False

Given the high severity score and potential for large-scale data compromise, administrators should treat this advisory with urgency. Apply the vendor-supplied updates immediately to secure user records against unauthorized access.