Threat database

CVE-2026-110467 is an authorization bypass vulnerability in WisdomGarden's Tronclass product. Authenticated remote attackers can exploit an insecure direct object reference (CWE-639) by modifying a user-controlled parameter to access peer review scores of any student. The vulnerability affects versions 1.77 and 1.78. The CVSS 4.0 base score is 5.3, indicating medium severity. No patch or vendor advisory is currently provided, and no known exploits are reported in the wild.

WisdomGarden's Tronclass versions 1.77 and 1.78 contain a vulnerability (CVE-2026-110466) that allows authenticated remote attackers to bypass anonymous grading restrictions and access anonymous student information. This issue is classified as a sensitive data exposure (CWE-497) with a medium severity rating and a CVSS 4.0 score of 5.3.

WisdomGarden's Tronclass versions 1.77 and 1.78 contain an insecure direct object reference vulnerability (CWE-639) that allows authenticated remote attackers with low privileges to modify a parameter and alter peer review scores of any student. The vulnerability has a medium severity with a CVSS 4.0 base score of 5.3. There is no indication of known exploits in the wild or available patches at this time.

Tronclass developed by WisdomGarden has a Insecure Direct Object Reference vulnerability. After obtaining a course ID, authenticated remote attackers to modify a specific parameter to obtain a course invitation code, thereby joining any course.

Tronclass developed by WisdomGarden has an Insecure Direct object Reference vulnerability, allowing remote attackers with regular privilege to modify a specific parameter to access other users' files.