CVE-2026-64969
Received Received - Intake

Insecure Direct Object Reference in ATutor Profile Picture Deletion

Publication date: 2026-08-20

Last updated on: 2026-08-20

Assigner: CERT.PL

Description
ATutor is vulnerable to Insecure Direct Object Reference (IDOR) attack in profile picture related endpoints. Any authenticated user, including a student, can supply another user's member_id in a POST request to the profile album endpoint and permanently delete that user's profile picture, including those of instructors and administrators. Product is no longer actively supported and the vulnerabilities have not been fixed. Only version 2.2.4 was tested and confirmed as vulnerable, other versions were not tested but might also be vulnerable.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-20
Last Modified
2026-08-20
Generated
2026-08-20
AI Q&A
2026-08-20
EPSS Evaluated
N/A
NVD
CVE-2026-64969
EUVD
EUVD-2026-63370

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
atutor atutor to 2.2.4 (exc)
atutor atutor to 2.2.4 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

ATutor has an Insecure Direct Object Reference (IDOR) vulnerability in profile picture endpoints. Authenticated users, including students, can delete other users' profile pictures by sending a POST request with another user's member_id to the profile album endpoint. This includes deleting pictures of instructors and administrators.

Detection Guidance

Since ATutor is no longer supported and lacks official patches, detection involves checking for unauthorized profile picture deletions via IDOR. Monitor HTTP POST requests to profile album endpoints for suspicious member_id parameters. Check server logs for repeated deletion attempts targeting different user IDs.

Impact Analysis

This vulnerability allows any authenticated user to permanently delete profile pictures of other users, including instructors and administrators. This could lead to loss of profile images, disruption of user profiles, and potential reputational damage for affected users.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by allowing unauthorized modification of user data (profile pictures). Unauthorized deletion of profile pictures may constitute a violation of data integrity and access controls required by these regulations.

Mitigation Strategies

Immediately disable or restrict access to the vulnerable profile picture endpoints. Implement strict input validation to prevent IDOR attacks. Upgrade to a supported alternative if possible. Monitor for unauthorized deletions and restrict user permissions to minimize impact.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-64969. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart