CVE-2026-64969 Insecure Direct Object Reference in ATutor

ATutor is vulnerable to Insecure Direct Object Reference IDOR attack in profile picture related endpoints. Any authenticated user, including a student, can supply another user's memberid in a POST request to the profile album endpoint and permanently delete that user's profile picture, including...

PT-2026-79017

ATutor is vulnerable to Insecure Direct Object Reference IDOR attack in profile picture related endpoints. Any authenticated user, including a student, can supply another user's member id in a POST request to the profile album endpoint and permanently delete that user's profile picture, including...

CVE-2026-64969: Authorization Bypass Through User-Controlled Key

ATutor is vulnerable to Insecure Direct Object Reference IDOR attack in profile picture related endpoints. Any authenticated user, including a student, can supply another user's memberid in a POST request to the profile album endpoint and permanently delete that user's profile picture, including...