CVE-2026-64969 in ATutor
Summary
by MITRE • 08/20/2026
ATutor is vulnerable to Insecure Direct Object Reference (IDOR) attack in profile picture related endpoints. Any authenticated user, including a student, can supply another user's member_id in a POST request to the profile album endpoint and permanently delete that user's profile picture, including those of instructors and administrators.
Product is no longer actively supported and the vulnerabilities have not been fixed. Only version 2.2.4 was tested and confirmed as vulnerable, other versions were not tested but might also be vulnerable.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/20/2026
The vulnerability identified in ATutor represents a critical failure in access control mechanisms, specifically classified under CWE-639: Insecure Direct Object Reference. This type of flaw occurs when an application exposes a reference to an internal implementation object, such as a database key or file path, without performing adequate authorization checks on the user's permission to access that specific resource. In this scenario, the profile picture management endpoints within ATutor rely directly on the member_id parameter provided by the client-side POST request to identify which user's profile image is being targeted for deletion. The system fails to verify whether the authenticated user initiating the request holds administrative privileges or possesses ownership of the target account. Consequently, any validly authenticated user can manipulate this identifier to perform actions against other users' data, bypassing intended security boundaries entirely.
The operational impact of this vulnerability is significant due to its potential for unauthorized modification and destruction of user-specific assets. An attacker with even minimal access levels, such as a standard student account, can exploit this flaw to permanently delete the profile pictures of instructors, administrators, or other students. This action not only results in data loss but also disrupts the integrity of the learning management system's social features. Beyond the immediate inconvenience and potential embarrassment caused by removing visual identities, this vulnerability demonstrates a broader lack of input validation and authorization logic that could potentially be leveraged for further attacks if similar patterns exist elsewhere in the application. The persistence of these vulnerabilities indicates that the product is no longer actively supported or maintained, leaving existing deployments exposed to exploitation without any possibility of official patches or security updates from the vendor.
From a threat modeling perspective aligned with MITRE ATT&CK frameworks, this vulnerability facilitates actions consistent with Defense Evasion and Impact tactics, specifically relating to data manipulation and disruption of service through resource destruction. The lack of server-side validation means that client-supplied identifiers are trusted implicitly, which is a fundamental anti-pattern in secure software development. To mitigate the risks associated with this flaw in environments where ATutor remains deployed despite its end-of-life status, immediate remediation strategies must focus on compensating controls since code-level fixes are unavailable. Administrators should implement strict access control policies at the network or application gateway level to restrict access to profile-related endpoints exclusively to authorized administrative roles if such functionality is not required by all users. Additionally, enabling comprehensive logging and monitoring for anomalous deletion patterns can help detect exploitation attempts in real-time. Given that version 2.2.4 was confirmed vulnerable and other versions remain untested but likely affected, the most robust long-term solution involves migrating to a supported alternative learning management system or isolating the instance from external networks until it can be decommissioned securely.