CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
What the vulnerability does
Authorization Bypass Through User-Controlled Key vulnerability in Themeum Tutor LMS tutor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Tutor LMS: from n/a through <= 3.9.13.
Explanation of Vulnerability in Simple Terms
Tutor LMS versions up to 3.9.13 contain an authorization flaw that allows authenticated users to modify data they should not have access to. An attacker with a low-privilege account can alter course content, student records, or other sensitive information without proper permission checks. This affects the integrity of course data and student progress tracking.
What an attacker can do
Modify course content, student records, or other data without proper authorization.
Potential impact on your site
Course data and student records can be altered by unauthorized users, compromising data integrity and course validity.
Conditions required to exploit
Attacker must have a low-privilege account on the site (e.g., student or basic user role).
Key dates
External resources
Related vulnerabilities
