Missing Authorization Check in ATutor by A Tutor Team
CVE-2026-64965

5.3MEDIUM

Key Information:

Vendor

Atutor

Status
Atutor
Vendor
CVE Published:
20 August 2026

What is CVE-2026-64965?

ATutor has a vulnerability that allows low-privileged authenticated users, such as students enrolled in a course, to exploit missing authorization checks on the Test and Question Import endpoints. By directly sending requests to these backend endpoints, these users can bypass security measures and import tests and questions without proper authorization. This flaw poses significant risks to course integrity and overall platform security. Note that ATutor version 2.2.4 has been confirmed as vulnerable, while other versions may also be affected but remain untested.

Affected Version(s)

ATutor 2.2.4

References

https://cert.pl/en/posts/2026/08/CVE-2026-64960
third-party-advisory
https://atutor.github.io/
product

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Michał Majchrowicz (AFINE Team)
Marcin Wyczechowski (AFINE Team)
.