CVE-2026-64962
Received Received - Intake

Cross-Site Request Forgery in ATutor Profile Update

Publication date: 2026-08-20

Last updated on: 2026-08-20

Assigner: CERT.PL

Description
ATutor is vulnerable to Cross-Site Request Forgery (CSRF) in profile update functionality. An attacker can craft a malicious website which, when visited by an authenticated victim, submits a forged request to the system. Due to the lack of proper CSRF token implementation, the forged request is processed successfully, allowing an attacker to modify profile fields of an existing user. Product is no longer actively supported and the vulnerabilities have not been fixed. Only version 2.2.4 was tested and confirmed as vulnerable, other versions were not tested but might also be vulnerable.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-20
Last Modified
2026-08-20
Generated
2026-08-20
AI Q&A
2026-08-20
EPSS Evaluated
N/A
NVD
CVE-2026-64962
EUVD
EUVD-2026-63362

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
atutor atutor From 2.2.4 (exc)
atutor atutor to 2.2.4 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-352 The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

ATutor is vulnerable to Cross-Site Request Forgery (CSRF) in its profile update functionality. An attacker can create a malicious website that, when visited by an authenticated user, automatically submits a forged request to modify the user's profile without their consent. This occurs because the system lacks proper CSRF token implementation, allowing unauthorized changes to profile fields.

Detection Guidance

Since ATutor 2.2.4 is no longer supported and lacks CSRF protection, detection involves checking for unauthorized profile modifications or unusual HTTP requests. Monitor web server logs for POST requests to /atutor/users/index.php without CSRF tokens. Look for repeated profile update attempts from suspicious sources.

Impact Analysis

This vulnerability allows an attacker to change your profile information without your knowledge or consent. This could lead to unauthorized modifications of your account details, potential impersonation, or further exploitation of your account if combined with other vulnerabilities.

Compliance Impact

This CSRF vulnerability could potentially violate compliance with GDPR and HIPAA by allowing unauthorized modification of user profiles. Unauthorized changes to user data may lead to breaches of data integrity and confidentiality requirements under these regulations.

Mitigation Strategies

Immediately upgrade to a supported version if available. If not, disable user profile updates via ATutor's admin panel or block external POST requests to profile update endpoints. Implement network-level protections like WAF rules to block CSRF attempts. Consider migrating to an actively maintained LMS.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-64962. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart