CVE-2026-110467 in Tronclass
Summary
by MITRE • 10/15/2026
Tronclass developed by WisdomGarden has a Insecure Direct Object Reference vulnerability. Authenticated remote attackers can modify a specific parameter to view the peer review scores of any student.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/15/2026
The identified security flaw within Tronclass, an educational platform developed by WisdomGarden, represents a critical failure in access control mechanisms known as an Insecure Direct Object Reference or IDOR. This vulnerability allows authenticated remote attackers to manipulate specific input parameters associated with database object identifiers. By altering these values, typically found in URLs, API requests, or form submissions, the application fails to verify whether the requesting user has the legitimate authority to access the underlying data resource. Instead of enforcing proper authorization checks against the session context and role permissions, the system blindly trusts the provided identifier, leading to a direct exposure of sensitive internal objects such as peer review scores for any student in the database rather than just those associated with the authenticated user's account or class roster.
From a technical perspective, this flaw stems from insufficient server-side validation where the application maps client-supplied input directly to backend queries without verifying ownership or administrative privileges. In educational software like Tronclass, peer review scores are often considered sensitive academic data that may influence grading outcomes and student privacy compliance. The ability for an attacker with valid credentials but potentially lower privilege levels, such as a regular student, to access the records of other students indicates a breakdown in role-based access control logic. This is not merely a display issue but constitutes a significant breach of confidentiality where private academic performance metrics are exposed to unauthorized parties through simple parameter tampering techniques available via standard web debugging tools or automated scripts.
The operational impact of this vulnerability extends beyond mere data leakage, potentially affecting the integrity and fairness of the educational process. Peer review scores often contribute significantly to final grades in collaborative learning environments. If an attacker can view these scores for any student, they may engage in academic dishonesty by identifying patterns, copying high-quality work, or even manipulating perceptions of peer feedback before it is officially recorded. Furthermore, this exposure violates fundamental privacy principles and potentially breaches regulatory frameworks such as FERPA in the United States or GDPR in Europe, which mandate strict controls over who can access personally identifiable information linked to educational records. The trust placed by students and institutions in the platform's ability to isolate data per user session is fundamentally compromised, leading to potential reputational damage for WisdomGarden and loss of confidence among its user base.
To mitigate this vulnerability, developers must implement robust authorization checks at every point where sensitive data is accessed or modified. This involves ensuring that all requests involving peer review scores are validated against the current user's identity and role permissions on the server side, rather than relying solely on client-side restrictions which can be easily bypassed. The application should verify that the requesting user has a direct relationship with the target student record, such as being enrolled in the same class or holding an instructor/administrator role. Additionally, implementing indirect object references by mapping internal database IDs to random, non-sequential identifiers can reduce the predictability of these values, although this is secondary to proper access control logic. Regular security testing including penetration tests focused on broken access control and automated static analysis tools configured to detect CWE-639 patterns should be integrated into the development lifecycle to prevent similar flaws in future releases.