The vulnerability is an insecure direct object reference (IDOR) in the Tronclass application from WisdomGarden. An authenticated attacker can alter a specific parameter to modify peer review scores for any student, undermining the integrity of academic evaluations. The flaw is identified as CWE‑639, reflecting the lack of proper access control to protected resources.

Affected products include WisdomGarden’s Tronclass platform. The issue has been addressed in version 1.77.123590‑hotfix or later, and version 1.78.123589‑hotfix or later. All earlier releases are vulnerable, and organizations should verify that they are running one of the patched versions.

The CVSS score of 5.3 indicates moderate severity. EPSS <1% signals a very low likelihood of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Attackers must be authenticated and remotely access the web interface to manipulate review parameters, demonstrating that the risk is confined to environments where users have sufficient privileges to submit reviews.