ATutor suffers from a missing authorization check on its Test and Question Import endpoints, allowing a low-privileged authenticated user—such as a student enrolled in a course—to bypass controls and upload new content. This flaw can let an attacker alter course assessments without the request being logged or validated against the user’s role. The impact is limited to modification of course data but could be leveraged to inject misleading or malicious material, thereby compromising the learning experience and integrity of assessment results.

The vulnerability affects ATutor, specifically version 2.2.4, and potentially other untested releases. The product is no longer actively maintained, and no fix has been released by the vendor.

The CVSS score of 5.3 indicates a moderate severity. Because the vulnerability requires authentication, the attack surface is limited to users who are legitimately logged into the system. An attacker could craft HTTP requests directly to the import endpoints using a legitimate user’s session cookie, bypassing standard checks. The EPSS score is unavailable, and the issue is not listed in CISA’s KEV catalog, suggesting that it is not widely exploited yet, but the lack of vendor remediation increases the risk of future exploitation.