CVE-2026-2997: WisdomGarden｜Tronclass - Insecure Direct Object Reference

Published Feb 23, 2026

Updated

Tronclass developed by WisdomGarden has a Insecure Direct Object Reference vulnerability. After obtaining a course ID, authenticated remote attackers to modify a specific parameter to obtain a course invitation code, thereby joining any course.

Affected Software

1 affected component

WisdomGarden Tronclass

Remediation

Information

Update to version 1.77 or later.

Event History

Feb 23, 2026

CVE Published

via MITRE·01:55 AM

Data Sourced

via MITRE·01:55 AM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·03:15 AM

DescriptionSeverityWeakness

Apr 10, 58134

Event

via FIRST·06:30 AM

Frequently Asked Questions

What is the severity of CVE-2026-2997?

CVE-2026-2997 is classified as a medium severity vulnerability due to its ability to allow authenticated attackers to exploit insecure direct object references.

How do I fix CVE-2026-2997?

To fix CVE-2026-2997, implement proper access controls and validation for user-referenced objects in the application.

Who is affected by CVE-2026-2997?

CVE-2026-2997 affects users of the WisdomGarden Tronclass platform, specifically those interacting with course ID parameters.

What type of vulnerability is CVE-2026-2997?

CVE-2026-2997 is an Insecure Direct Object Reference vulnerability, allowing unauthorized access to resources.

Can CVE-2026-2997 be exploited remotely?

Yes, CVE-2026-2997 can be exploited remotely by authenticated attackers with knowledge of course IDs.