Researchers urge Gibbon school software deployments to separate student records from public login pages

A security-focused article argues that Gibbon, an open-source school management platform covering student profiles, attendance, and enrolment, should keep sensitive school data distinct from its publicly visible login or admissions pages. It notes that search-engine queries found 872 hosts matching the application name and 632 matching its title, though a name match alone does not show that records are exposed. The piece emphasizes reviewing permissions for each role such as administrators, teachers, parents, and support staff, especially for impersonation, messaging, and medical or safeguarding fields. It also recommends verifying OAuth2 login behavior, ensuring external identities do not automatically receive administrator rights, and testing session expiry and account deactivation. Its closing guidance is that organizations should confirm host ownership and monitor authentication and permission events rather than act on version-based assumptions.