An insecure direct object reference in the Educativa Campus application allows an attacker to craft URLs targeting the '/archivos/usuarios/[ID]/[username]/thumb_AAxAA.jpg' path and retrieve profile pictures of any user without authentication. Once collected, these photos can be used to impersonate identities, facilitate social engineering, link accounts across platforms via facial recognition, or carry out doxxing. The vulnerability resides in the absence of proper object‑level access control, corresponding to CWE‑284.

The affected product is Educativa Campus version 14.05.00-35. The vendor has released a fix in version 14.05.00-159 and later releases. No other versions or products are listed as vulnerable.

The CVSS score of 6.9 indicates moderate severity. The EPSS score of less than 1% suggests a low likelihood of exploitation in the wild, and the vulnerability is not currently included in the CISA KEV catalog. The attack vector is inferred to be remote via manipulated URLs, requiring no user interaction beyond accessing the crafted link. Once exploited, the attacker gains read access to all user profile photos, compromising privacy and enabling further malicious activities.