CVE-2026-85209: IDOR in AVEZ Electronics's LMS
Missing Authorization vulnerability in AVEZ Electronics Communication Training and Consultancy Trade Inc. Learning Management System (LMS) allows Exploiting Incorrectly Configured Access Control Security Levels.
This issue affects Learning Management System (LMS): through 2026-09-18.
Affected Software
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
The reported CVSS vector indicates that an attacker needs low-level privileges (PR:L). Exploitation is network-accessible, requires no user interaction, and has low attack complexity.
What is the likely impact if exploitation succeeds?
The vulnerability is rated as having high confidentiality impact, with no reported integrity or availability impact. This indicates unauthorized access to information is the primary concern.
Which deployments are identified as affected?
The advisory identifies AVEZ Electronics Learning Management System (LMS) deployments as affected through 2026-09-18. No fixed version or configuration-specific mitigation is provided in the available data.