CVE-2026-110465: WisdomGarden｜Tronclass - Insecure Direct Object Reference
Tronclass developed by WisdomGarden has a Insecure Direct Object Reference vulnerability. Authenticated remote attackers can modify a specific parameter to alter the peer review scores of any student.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.77.123590-hotfix - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.78.123589-hotfix
Event History
Frequently Asked Questions
Who can exploit this vulnerability?
An attacker must be authenticated to Tronclass and able to reach the application remotely. The supplied information does not indicate that unauthenticated users can exploit it.
What could an attacker change?
By modifying a specific parameter, an authenticated attacker can alter the peer review scores of any student. The provided information does not describe impacts beyond peer review score integrity.
What should administrators investigate if compromise is suspected?
Review peer review score changes for unexpected modifications, especially changes associated with accounts that should not have been able to affect the targeted student's score. The vulnerability involves parameter manipulation by authenticated users.