Cross-Site Request Forgery Vulnerability in ATutor by ATutor Development Team
CVE-2026-64962

5.1MEDIUM

Key Information:

Vendor

Atutor

Status
Atutor
Vendor
CVE Published:
20 August 2026

What is CVE-2026-64962?

ATutor, an open-source learning management system, is susceptible to a Cross-Site Request Forgery (CSRF) flaw that affects its profile update functionality. An attacker can exploit this vulnerability by designing a malicious website. When an authenticated user visits this site, it can trigger a forged request that modifies the user's profile fields without their consent. This exploitation is made possible due to ATutor's failure to implement adequate CSRF tokens, allowing the attack to succeed unimpeded. It's important to note that ATutor version 2.2.4 has been confirmed to be vulnerable, and since the product is no longer actively supported, no fixes are available to mitigate this risk.

Affected Version(s)

ATutor 2.2.4

References

https://cert.pl/en/posts/2026/08/CVE-2026-64960
third-party-advisory
https://atutor.github.io/
product

CVSS V4

Score:
5.1
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Michał Majchrowicz (AFINE Team)
Marcin Wyczechowski (AFINE Team)
.