Tronclass CVE-2026-110467

Exploitation requires a valid authenticated session on the target Tronclass instance (PR:L), so the attacker must already hold a legitimate account on that deployment. The specific prerequisite is access to the peer-review scoring feature, where a client-controlled object identifier (e.g., a student or submission parameter) is not validated against the requester's identity; the attacker modifies that parameter to reference another student's record. Limiting factors: the attacker cannot act unauthenticated, exploitation is confined to reading peer-review scores (no write/modification and no broader data exposure per VI:N/VA:N), and impact is limited to the confidentiality of that specific data type. No special non-default configuration is indicated as required.

This is a genuine but low-to-moderate priority issue. The CVSS 4.0 base score of 5.3 (medium) is consistent with the vulnerability's narrow impact: the vector (AV:N/AC:L/AT:N/PR:L/UI:N) describes network-reachable, low-complexity exploitation that nonetheless REQUIRES authentication (PR:L) and yields only low confidentiality impact (VC:L) with no integrity or availability impact (VI:N/VA:N). This is a textbook Insecure Direct Object Reference (CWE-639) - a user with a legitimate account manipulates an object identifier to read data belonging to other users. No EPSS score was provided in the input, and there is no CISA KEV listing and no public proof-of-concept referenced, so there is no public exploit identified at time of analysis. The absence of active-exploitation signals, combined with the authentication requirement and the limited (read-only, single data-type) impact, means this does not rise to emergency-patch urgency. The only data note worth flagging: the input Tag labels this 'Authentication Bypass,' but the CWE (CWE-639) and description describe an authorization/access-control flaw by an already-authenticated user, not a bypass of authentication - these are distinct and the tag is misleading. Net: a legitimate confidentiality/privacy defect worth remediating in a normal patch cycle, not a widespread-exploitation emergency.

An authenticated Tronclass user (e.g., an enrolled student) intercepts or crafts a request to the peer-review feature and alters an object identifier parameter - such as a student ID or submission ID - to a value belonging to another student. The server returns that other student's peer-review scores without verifying ownership. No public exploit code is referenced, but the low attack complexity (AC:L) means exploitation requires only trivial parameter tampering with a standard web proxy.