EUVD-2026-79943Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Unauthenticated remote API reads with no user interaction (PR:N/UI:N) and only confidentiality impact, so C:H with I:N/A:N.
Primary rating from Vendor (github).
CVSS VectorVendor: github
Lifecycle Timeline
5DescriptionCVE.org
tts-be is a backend for a timetable selector that aims to help students better choose their class schedules. Versions prior to 2.1.0 have a Broken Access Control vulnerability across several API endpoints (such as /api/student/{id}/photo and /api/course_unit/{id}/exchange/metadata). By chaining these unauthenticated endpoints, a remote attacker can use the backend as an open proxy to bypass authorization checks, allowing for the enumeration and extraction of sensitive Personally Identifiable Information (PII) from upstream university systems. The exposed data includes full names, student IDs, class schedules, and photos. This issue was fixed in version 2.1.0.
AnalysisAI
Broken access control in the tts-be timetable backend (all versions prior to 2.1.0) lets unauthenticated remote attackers chain several public API endpoints - including /api/student/{id}/photo and /api/course_unit/{id}/exchange/metadata - and abuse the server as an open proxy against upstream university systems. The result is enumeration and extraction of student PII such as full names, student IDs, class schedules and photographs, with no authentication or user interaction required. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | No special conditions are required: the CVSS vector is AV:N/AC:L/PR:N/UI:N, meaning remote unauthenticated exploitation against a default deployment of tts-be prior to 2.1.0, with no user interaction and no prior account. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N (7.5) is consistent with the description: fully unauthenticated, low-complexity, network-reachable reads with no integrity or availability impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to tts-be 2.1.0 or later, which is the vendor-confirmed fix for this advisory (GHSA-fpfp-hr42-fvpm). … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-200 – Information Exposure
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today