Tronclass contains an Insecure Direct Object Reference that allows an authenticated remote attacker to modify a course identifier parameter and retrieve a course invitation code. By doing so, the attacker can join any course without proper authorization, effectively bypassing access controls and gaining unintended access to course content.

The affected product is WisdomGarden’s Tronclass. All versions released prior to 1.77 are vulnerable; the vendor recommends upgrading to version 1.77 or later to mitigate the issue.

The CVSS score of 6.5 reflects moderate impact, while an EPSS score of less than 1% indicates a very low likelihood of exploitation at this time. The vulnerability is not currently listed in CISA’s KEV catalog. Exploitation requires authenticated access; once authenticated, an attacker can manipulate the course ID to obtain an invitation code and enroll in the course, evidencing an IDOR flaw.