CVE-2026-88065: `tts-be` application has a Broken Access Control vulnerability
tts-be is a backend for a timetable selector that aims to help students better choose their class schedules. Versions prior to 2.1.0 have a Broken Access Control vulnerability across several API endpoints (such as /api/student/{id}/photo and /api/courseunit/{id}/exchange/metadata). By chaining these unauthenticated endpoints, a remote attacker can use the backend as an open proxy to bypass authorization checks, allowing for the enumeration and extraction of sensitive Personally Identifiable Information (PII) from upstream university systems. The exposed data includes full names, student IDs, class schedules, and photos. This issue was fixed in version 2.1.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
tts-beto a version that resolves this vulnerability.Fixed in 2.1.0
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments running tts-be versions prior to 2.1.0 are affected. The vulnerable API endpoints are unauthenticated, so exposure does not require attacker credentials.
What can an attacker obtain through exploitation?
An attacker can chain the affected endpoints to use the backend as an open proxy and bypass authorization checks in upstream university systems. The disclosed PII can include full names, student IDs, class schedules, and photos.
What should teams do if they cannot patch immediately?
The provided information identifies version 2.1.0 as the fix. No alternative mitigation or workaround is specified.