CVE-2026-88065: Exposure of Sensitive Information to an Unauthorized Actor

tts-be is a backend for a timetable selector that aims to help students better choose their class schedules. Versions prior to 2.1.0 have a Broken Access Control vulnerability across several API endpoints such as /api/student/id/photo and /api/courseunit/id/exchange/metadata. By chaining these...

PT-2026-93125

Name of the Vulnerable Software and Affected Versions tts-be versions prior to 2.1.0 Description Broken Access Control exists across several API endpoints, including '/api/student/id/photo' and '/api/course unit/id/exchange/metadata'. By chaining these unauthenticated endpoints, a remote attacker...