CVE-2026-64965

ATutor is vulnerable to Missing Authorization Check on Test and Question Import endpoints. A low-privileged authenticated user (e.g. a student) enrolled in a course can bypass authorization checks by sending requests directly to the backend import endpoints, allowing the unauthorized import of tests and questions within a course. Product is no longer actively supported and the vulnerabilities have not been fixed. Only version 2.2.4 was tested and confirmed as vulnerable, other versions were not tested but might also be vulnerable.

CVSS

No CVSS.

References

Link	Resource
https://atutor.github.io/
https://cert.pl/en/posts/2026/08/CVE-2026-64960

Configurations

No configuration.

History

27 Oct 2026, 10:10

Type	Values Removed	Values Added
Summary		(es) ATutor es vulnerable a la falta de verificación de autorización en los puntos finales de importación de exámenes y preguntas. Un usuario autenticado con bajos privilegios (por ejemplo, un estudiante) inscrito en un curso puede eludir las verificaciones de autorización enviando solicitudes directamente a los puntos finales de importación del backend, permitiendo la importación no autorizada de exámenes y preguntas dentro de un curso. El producto ya no recibe soporte activo y las vulnerabilidades no han sido corregidas. Solo la versión 2.2.4 fue probada y confirmada como vulnerable; otras versiones no fueron probadas pero también podrían ser vulnerables.

Information

Published : 2026-08-20 14:17

Updated : 2026-10-27 10:10

NVD link : CVE-2026-64965

Mitre link : CVE-2026-64965

CVE.ORG link : CVE-2026-64965

JSON object : View

Products Affected

No product.

CWE

CWE-862

Missing Authorization

{"id": "CVE-2026-64965", "cveTags": [{"tags": ["unsupported-when-assigned"], "sourceIdentifier": "cvd@cert.pl"}], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-64965", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-20T14:59:44.253284Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "cvd@cert.pl", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 5.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "cvd@cert.pl", "affectedData": [{"repo": "https://github.com/atutor/ATutor", "vendor": "ATutor", "product": "ATutor", "versions": [{"status": "affected", "version": "2.2.4", "versionType": "semver"}], "defaultStatus": "unknown"}]}], "published": "2026-08-20T14:17:45.133", "references": [{"url": "https://atutor.github.io/", "source": "cvd@cert.pl"}, {"url": "https://cert.pl/en/posts/2026/08/CVE-2026-64960", "source": "cvd@cert.pl"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "cvd@cert.pl", "description": [{"lang": "en", "value": "CWE-862"}]}], "descriptions": [{"lang": "en", "value": "ATutor is vulnerable to Missing Authorization Check on Test and Question Import endpoints.\u00a0\u00a0A low-privileged authenticated user\u00a0(e.g. a student)\u00a0enrolled in a course can bypass authorization checks by sending requests directly to the backend import endpoints, allowing the unauthorized import of tests and questions within a course.\n\n\n\n\nProduct is no longer actively supported and the vulnerabilities have not been fixed. Only version 2.2.4 was tested and confirmed as vulnerable, other versions were not tested but might also be vulnerable."}, {"lang": "es", "value": "ATutor es vulnerable a la falta de verificaci\u00f3n de autorizaci\u00f3n en los puntos finales de importaci\u00f3n de ex\u00e1menes y preguntas. Un usuario autenticado con bajos privilegios (por ejemplo, un estudiante) inscrito en un curso puede eludir las verificaciones de autorizaci\u00f3n enviando solicitudes directamente a los puntos finales de importaci\u00f3n del backend, permitiendo la importaci\u00f3n no autorizada de ex\u00e1menes y preguntas dentro de un curso.\n\nEl producto ya no recibe soporte activo y las vulnerabilidades no han sido corregidas. Solo la versi\u00f3n 2.2.4 fue probada y confirmada como vulnerable; otras versiones no fueron probadas pero tambi\u00e9n podr\u00edan ser vulnerables."}], "lastModified": "2026-10-27T10:10:00.240", "sourceIdentifier": "cvd@cert.pl"}