Student-record disclosure via unchecked aluno_id

Improper authorization in Portábilis iEducar 2.0 through 2.10 allows remote authenticated users to read other students’ records. The /module/Api/aluno endpoint accepts an attacker-selected aluno_id and returns the referenced student’s data without verifying access to that student. A valid low-privilege session is required, and the demonstrated consequence is enumeration and disclosure of student records rather than administrative control.