Description
Tronclass developed by WisdomGarden has a Sensitive Data Exposure vulnerability. Authenticated remote attackers can bypass anonymous grading restrictions and obtain anonymous student information.
Published: 2026-10-14
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Sensitive Data Exposure
Action: Immediate Patch
AI Analysis

Impact

Tronclass by WisdomGarden has a vulnerability that allows authenticated remote attackers to bypass anonymous grading restrictions and obtain anonymous student information.

Affected Systems

The vulnerability affects WisdomGarden’s Tronclass product. Versions prior to 1.77.123590-hotfix and 1.78.123589-hotfix are impacted. Updating to either of these hotfix releases resolves the issue.

Risk and Exploitability

The CVSS score of 5.3 indicates a medium severity. The EPSS score is below 1 %, implying a low likelihood of exploitation at this time. The vulnerability is not listed in the CISA KEV catalog. Attackers must authenticate to the system before exploiting the flaw, suggesting that the attack vector is remote authenticated access. Once authenticated, the attacker can extract confidential student data that was meant to remain anonymous.

Generated by OpenCVE AI on October 16, 2026 at 00:21 UTC.

Remediation

Vendor Solution

Please update to version 1.77.123590-hotfix or later Please update to version 1.78.123589-hotfix or later

OpenCVE Recommended Actions

  • Apply the 1.77.123590-hotfix or later release of Tronclass to eliminate the flaw.
  • Apply the 1.78.123589-hotfix or later release of Tronclass if the previous hotfix is unavailable or if further remediation is required.
  • If a patch cannot be applied immediately, temporarily restrict or disable the grading feature that exposes anonymous student data and enforce strict role‑based access controls to limit who can view or modify student information.

Generated by OpenCVE AI on October 16, 2026 at 00:21 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sat, 17 Oct 2026 11:30:00 +0000

Type Values Removed Values Added
First Time appeared Wisdomgarden
Wisdomgarden tronclass
Vendors & Products Wisdomgarden
Wisdomgarden tronclass

Wed, 14 Oct 2026 17:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 14 Oct 2026 06:45:00 +0000

Type Values Removed Values Added
Description Tronclass developed by WisdomGarden has a Sensitive Data Exposure vulnerability. Authenticated remote attackers can bypass anonymous grading restrictions and obtain anonymous student information.
Title WisdomGarden｜Tronclass - Sensitive Data Exposure
Weaknesses CWE-497
References
Metrics cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

Wisdomgarden Tronclass
cve-icon MITRE

Status: PUBLISHED

Assigner: twcert

Published:

Updated: 2026-10-14T16:00:21.597Z

Reserved: 2026-10-14T06:12:29.775Z

Link: CVE-2026-110466

cve-icon Vulnrichment

Updated: 2026-10-14T16:00:06.627Z

cve-icon NVD

Status : Deferred

Published: 2026-10-14T07:17:02.680

Modified: 2026-10-15T15:53:08.287

Link: CVE-2026-110466

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-17T11:15:07Z

Weaknesses
  • CWE-497

    Exposure of Sensitive System Information to an Unauthorized Control Sphere