Tronclass CVE-2026-110466

Exploitation requires the attacker to hold valid authenticated credentials on the target Tronclass instance (PR:L) and requires that the anonymous grading feature be in use for the targeted course/assignment - the vulnerability specifically allows bypassing the anonymous grading restriction to reveal student identities. There is no user interaction required (UI:N) and the attack is network-reachable (AV:N). Limiting factors: an attacker without a valid account cannot exploit this, and the exposure is confined to anonymous student information within graded submissions (Low confidentiality impact, no integrity or availability effect), so impact is scoped to a privacy/data-disclosure concern rather than system takeover.

This is a medium-severity information disclosure flaw (CVSS 5.3 via the vendor-supplied CVSS 4.0 vector AV:N/AC:L/PR:L/UI:N/VC:L) with no amplifying real-world exploitation signals. No EPSS score was provided in the input, there is no CISA KEV listing (KEV=NO), and no public exploit code was identified (POC=NO), so exploitation status is 'no public exploit identified at time of analysis.' The CVSS vector requires authentication (PR:L), meaning this is not a pre-auth mass-exploitable issue but rather an authenticated privilege/restriction-bypass against a specific application feature, which substantially lowers real-world urgency. The confidentiality impact is only Low (VC:L) and there is no integrity or availability impact (VI:N/VA:N), consistent with limited exposure of anonymous student grading data rather than full account or system compromise. No SSVC decision data was provided. Net assessment: a genuine but contained privacy/data-exposure issue of medium priority - prioritize patching in affected academic deployments, but this does not carry the hallmarks of a widely weaponized or urgently exploited vulnerability.

An attacker with legitimate authenticated access to a Tronclass instance (e.g., a student or instructor account) manipulates requests to the grading functionality to bypass the anonymous-grading restriction. By doing so, they de-anonymize submissions and retrieve the identities and associated information of students who were supposed to remain anonymous. No public proof-of-concept exploit code was identified at the time of analysis.