CVE-2026-110466 in Tronclass
Summary
by MITRE • 10/14/2026
Tronclass developed by WisdomGarden has a Sensitive Data Exposure vulnerability. Authenticated remote attackers can bypass anonymous grading restrictions and obtain anonymous student information.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/14/2026
The Tronclass learning management system, developed by WisdomGarden, contains a critical sensitive data exposure flaw that allows authenticated users to access confidential educational records without proper authorization. This vulnerability specifically targets the platform's anonymization mechanisms used during academic assessments. In many institutional settings, maintaining student anonymity is crucial for ensuring fair grading practices and protecting privacy under regulations such as FERPA or GDPR. The system fails to enforce these restrictions correctly when handling requests related to anonymous evaluations, creating a significant gap in access control logic that can be exploited by malicious actors within the network perimeter.
The technical root cause of this issue lies in an improper authorization check on the server side processing grading and student data queries. Although the application is designed to strip or hide personally identifiable information from students during the anonymous review process, it fails to validate whether the requesting user has legitimate permission to view that specific subset of data. Authenticated remote attackers can manipulate API endpoints or HTTP requests associated with the grading module to bypass these restrictions. By crafting specific queries, an attacker can retrieve detailed student profiles including names, identification numbers, and potentially other sensitive academic history linked to anonymous submissions. This indicates a failure in implementing robust object-level access controls where the system does not verify that the user's role aligns with the sensitivity of the data being requested.
The operational impact of this vulnerability is severe for educational institutions relying on Tronclass for their administrative workflows. The exposure of student identities undermines the integrity of anonymous grading systems, potentially leading to bias in evaluation processes if instructors or administrators can identify students during review periods. Furthermore, the unauthorized disclosure of personally identifiable information constitutes a direct violation of data protection standards and privacy laws. Institutions may face legal repercussions, loss of accreditation, and significant reputational damage due to such breaches. The ability for any authenticated user to access this data also suggests that lateral movement within the system could be facilitated if an attacker compromises one account to harvest broader datasets from other classes or departments where similar anonymization features are active.
To mitigate this risk, WisdomGarden must immediately deploy a patch that enforces strict server-side validation on all endpoints related to anonymous grading and student data retrieval. The fix should implement granular access control lists ensuring that only authorized personnel with specific roles can view non-anonymized records, even if they have general authentication credentials. Additionally, implementing comprehensive logging and monitoring for unusual query patterns targeting sensitive fields will help in detecting potential exploitation attempts in real-time. Institutions currently using the vulnerable version of Tronclass should restrict network access to the application until an update is applied and conduct a thorough audit of their data handling procedures to ensure compliance with industry standards such as CWE-200 Information Exposure and ATT&CK technique T1530 Data from Cloud Storage Object, which highlights risks associated with improper object-level permissions in cloud-based services.