CVE-2026-64965 in Atutor
Summary
by MITRE • 08/20/2026
ATutor is vulnerable to Missing Authorization Check on Test and Question Import endpoints. A low-privileged authenticated user (e.g. a student) enrolled in a course can bypass authorization checks by sending requests directly to the backend import endpoints, allowing the unauthorized import of tests and questions within a course.
Product is no longer actively supported and the vulnerabilities have not been fixed. Only version 2.2.4 was tested and confirmed as vulnerable, other versions were not tested but might also be vulnerable.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 08/20/2026
The vulnerability identified in ATutor represents a critical failure in access control mechanisms within the application's backend architecture, specifically affecting the endpoints responsible for importing tests and questions into course modules. This flaw is classified under CWE-862, which denotes Missing Authorization, indicating that the software fails to enforce proper checks on whether an authenticated user has the necessary permissions to perform a specific action. In this scenario, the system incorrectly assumes that any request originating from an authenticated session possesses valid authorization for all operations within that context, rather than validating the user's role against the specific resource being accessed. This architectural oversight allows individuals with low-privileged accounts, such as students enrolled in a course, to bypass intended restrictions and execute administrative or instructor-level functions without proper verification of their rights.
The operational impact of this vulnerability is significant because it enables unauthorized modification of educational content. By sending direct HTTP requests to the backend import endpoints, an attacker can inject malicious tests, questions, or configuration data into courses they are merely enrolled in as students. This capability undermines the integrity of the learning management system by allowing non-instructors to alter assessment materials that should be exclusively managed by course creators or administrators. The ability to import arbitrary content may lead to further security risks if the imported files contain malicious scripts or payloads designed to exploit other vulnerabilities within the application, thereby expanding the attack surface beyond simple data manipulation.
From a threat modeling perspective, this vulnerability aligns with MITRE ATT&CK technique T1078, specifically Valid Accounts and potentially T1534 for Internal Spearphishing if used in conjunction with social engineering, though primarily it falls under privilege escalation via authorization bypass. The lack of active support for the product exacerbates the risk profile significantly. Since version 2.2.4 is confirmed vulnerable and no patches have been released to address this issue, organizations relying on older versions face persistent exposure. While only specific versions were tested, the nature of such access control flaws often persists across multiple iterations unless explicitly remediated in subsequent releases, suggesting that unpatched systems remain at high risk for exploitation by malicious actors seeking to disrupt educational services or compromise user data through injected content.
Mitigation strategies must prioritize immediate isolation and replacement due to the absence of vendor-provided fixes. Organizations should restrict network access to ATutor instances using firewalls or reverse proxies to limit exposure to trusted internal networks only, thereby reducing the attack surface available to external adversaries. Implementing strict input validation and enforcing role-based access control checks at the application layer for all import endpoints is essential if any legacy version must remain in operation temporarily. However, given that the product is no longer actively supported, the most effective long-term solution involves migrating to a modern, maintained learning management system with robust security practices and regular patching cycles. Until such migration occurs, continuous monitoring of access logs for anomalous import activities can help detect potential exploitation attempts early.