CVE-2026-110467: CWE-639 Authorization Bypass Through User-Controlled Key in WisdomGarden Tronclass

Tronclass, developed by WisdomGarden, contains an insecure direct object reference vulnerability (CWE-639) that allows authenticated remote attackers to bypass authorization controls. By manipulating a specific parameter, attackers can access peer review scores of other students without proper permission. This issue affects versions 1.77 and 1.78 of the product. The CVSS 4.0 vector indicates the attack requires network access, low attack complexity, no privileges beyond authentication, no user interaction, and results in low confidentiality impact without integrity or availability impact.

An attacker with valid authentication can view confidential peer review scores of any student by exploiting this vulnerability. This compromises the confidentiality of student evaluation data but does not affect integrity or availability of the system.

No official patch or fix information is provided in the vendor advisory or CVE data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to authenticated users and monitor for unusual parameter manipulation attempts related to peer review score access.