Tutor Lms CVE-2025-32223

The CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N indicates this is a network-accessible vulnerability with low attack complexity that requires a valid user login but no user interaction. The high confidentiality impact (C:H) demonstrates attackers can read sensitive data; the lack of integrity or availability impact (I:N/A:N) suggests read-only access exposure. The requirement for authenticated access (PR:L) moderately reduces real-world risk compared to unauthenticated IDOR flaws, as attackers must first obtain valid credentials. While CVSS score of 6.5 is moderate-to-high, the actual exploitation risk depends on the data sensitivity stored in Tutor LMS instances (course materials, student progress, grades, personal information) and the ease of credential acquisition. The Patchstack report confirms this is a documented vulnerability with a clear patch path, suggesting vendor responsiveness. Without confirmed active exploitation (KEV status not indicated as known/exploited) or public POC availability, this appears to be a legitimate but not immediately critical threat requiring timely patching rather than emergency response.

An authenticated student user with access to Course A could manually modify API request parameters or URL object identifiers to reference Course B resources they are not enrolled in, retrieving course materials, quiz answers, or other confidential content. A malicious user with low-privilege credentials could automate this attack by iterating through sequential course IDs to extract sensitive instructional content and student grade data across the entire LMS platform. Since the attack vector is network-based (AV:N) and requires only valid credentials with low attack complexity (AC:L), a threat actor who obtains even weak user credentials through phishing or credential stuffing could immediately exploit this to access high-confidentiality course and enrollment data.