Tronclass EUVD-2026-100871

Requires a valid authenticated Tronclass session with at least low-privilege access (PR:L), typically an enrolled student or ordinary platform user - exploitation is NOT possible unauthenticated. The specific prerequisite is access to the peer-review scoring function, where a client-supplied object-reference parameter (identifying the review/score record) is not validated against the caller's ownership, allowing it to be changed to any other student's record. No user interaction by a victim is needed (UI:N), and no special non-default configuration is indicated; the limiting factors are the account requirement and the scope being restricted to peer-review score integrity (no data disclosure or service disruption).

This is a moderate, integrity-only authorization flaw (CWE-639, IDOR) whose signals are internally consistent rather than alarming. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) and the 5.3 score indicate network-reachable, low-complexity exploitation that nonetheless requires an authenticated low-privileged account (PR:L) - consistent with the description's 'authenticated remote attackers.' Impact is confined to integrity (VI:L); there is no confidentiality or availability impact (VC:N/VA:N), matching the described effect of altering peer-review scores. No EPSS score, CISA KEV listing, or public POC is present in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The practical risk is best read as targeted academic-integrity abuse (e.g., a logged-in student tampering with grades) rather than a broadly automatable or high-severity threat. No key signals conflict; the main limiting factor is the authentication requirement, and the primary caveat is sparse corroboration - the only sources are two TWCERT advisory pages with no independent vendor advisory, EPSS, or exploit telemetry.

A logged-in Tronclass user (e.g., an enrolled student) intercepts a peer-review submission request and changes an identifier parameter to reference another student's review record. Because the application fails to verify ownership of the referenced object, the attacker alters arbitrary students' peer-review scores. No public exploit code is identified, but the attack requires only a valid low-privileged account and no special tooling.