Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.3

ATutor lets students add quizzes without permission

CVE-2026-64965 · published 2 months ago
Summary

In ATutor, a student who is logged in can send special requests to the system and upload test files or questions into a course they are taking, even though they should not be allowed to do so. This could let anyone on the platform add unwanted or incorrect material to courses. The only version confirmed to have this problem is 2.2.4; the software is no longer being updated, so the safest step is to stop using ATutor or move to a supported learning platform.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
atutor atutor 2.2.4
Original advisory text
Missing Authorization Check in ATutor
ATutor is vulnerable to Missing Authorization Check on Test and Question Import endpoints.  A low-privileged authenticated user (e.g. a student) enrolled in a course can bypass authorization checks by sending requests directly to the backend import endpoints, allowing the unauthorized import of tests and questions within a course.




Product is no longer actively supported and the vulnerabilities have not been fixed. Only version 2.2.4 was tested and confirmed as vulnerable, other versions were not tested but might also be vulnerable.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker partial control (estimated)
Severity
7.3 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-862Missing Authorization
Timeline
Published20 Aug 2026
Updated4 Nov 2026
First seen20 Aug 2026
Sources
CVE-2026-64965 · NVD
CVE-2026-64965 · MITRE
CVE-2026-64965 · OSV
Track software like this
Free during beta