CVE-2026-64969: Insecure Direct Object Reference in ATutor
ATutor is vulnerable to Insecure Direct Object Reference (IDOR) attack in profile picture related endpoints. Any authenticated user, including a student, can supply another user's memberid in a POST request to the profile album endpoint and permanently delete that user's profile picture, including those of instructors and administrators.
Product is no longer actively supported and the vulnerabilities have not been fixed. Only version 2.2.4 was tested and confirmed as vulnerable, other versions were not tested but might also be vulnerable.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue and what access do they need?
Any authenticated ATutor user can exploit it, including a student. The attacker needs to submit a POST request to a profile album endpoint with another user's member_id.
What is the impact on targeted accounts?
An attacker can permanently delete another user's profile picture. This includes profile pictures belonging to instructors and administrators.
Is a fix available, and what should be done if patching is not possible?
The product is no longer actively supported and the vulnerability has not been fixed. The provided information does not identify a mitigation; organizations should treat authenticated student access as sufficient to target other users' profile pictures.
Which versions are known to be affected?
Version 2.2.4 was tested and confirmed vulnerable. Other versions were not tested, but may also be vulnerable.