CVE-2026-110467: WisdomGarden｜Tronclass - Insecure Direct Object Reference
Tronclass developed by WisdomGarden has a Insecure Direct Object Reference vulnerability. Authenticated remote attackers can modify a specific parameter to view the peer review scores of any student.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WisdomGarden Tronclassto a version that resolves this vulnerability.Fixed in 1.77.123590-hotfix - Upgrade
Upgrade
WisdomGarden Tronclassto a version that resolves this vulnerability.Fixed in 1.78.123589-hotfix
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must be authenticated to Tronclass and able to make remote requests. The vulnerability does not require user interaction or complex attack conditions.
What information could be exposed?
An authenticated attacker can alter a specific parameter to view peer review scores belonging to any student. The available information indicates confidentiality impact only; integrity and availability are not affected.
How can administrators determine whether the issue has been exploited?
The provided information does not identify affected request paths, parameter names, log indicators, or detection methods. Review application and access logs for authenticated requests accessing peer review score records outside the requesting user's expected scope.