ATutor fails to validate ownership of profile picture resources. When a logged‑in user posts a request to the profile picture deletion endpoint with another member_id, the system treats the request unconditionally and permanently removes that member’s image, affecting students, instructors, and administrators alike. The vulnerability is an Insecure Direct Object Reference that damages data integrity by allowing arbitrary deletion of protected assets.

ATutor version 2.2.4, the only tested release confirmed to be vulnerable; other releases have not been evaluated but may also suffer the same flaw. Product obsolescence is noted, as continued support for ATutor has ceased.

The CVSS score of 5.3 indicates moderate severity; EPSS is not available and the vulnerability is not listed in the CISA KEV catalog. The exploit path requires that the attacker be authenticated to the LMS. Once authenticated, the attacker can craft a POST request to the deletion endpoint, specifying any member_id, resulting in permanent loss of profile pictures. While no remote code execution is possible, the loss of instructor and administrator photos could impair institutional trust and operational integrity.