CVE-2026-64965

This CVE exposes a fundamental authorization failure in ATutor, an abandoned open-source learning management system: students can import tests into courses where they should only have learner access. The root cause is straightforward — the backend endpoint for test import never received server-side role verification, even though the frontend likely hid the import button from student users. This is the pattern where authentication gets confused with authorization, and it's disturbingly common in academic software from the 2005-2015 era. The CVSS 5.3 rating is inadequate for this vulnerability's actual impact. In an educational environment, a student who can import arbitrary test content can inject XSS payloads into assessment interfaces that fire when instructors review or administer those tests, import phishing content that carries institutional trust signals, and corrupt grade integrity by manipulating scoring parameters. The CVSS vector doesn't account for this insider-threat context — the same gap appears when you trace similar authorization bypasses through WebCT, Blackboard, and Moodle over the past two decades. This is a recurring failure mode in educational LMS platforms, always rated 'medium,' and rarely remediated. The abandoned status compounds the problem in ways the EPSS score of 0.00282 doesn't capture. ATutor's repository is likely inaccessible for commit-level analysis, meaning the birth defect versus regression question may be structurally unanswerable. More critically, the 'medium' rating gives institutional security teams implicit permission to defer action — especially when the system runs on internal networks behind VPNs assumed to provide protection. The vulnerability becomes invisible not because it was fixed, but because it was categorized away. Meanwhile, the frozen codebase runs against a PHP version and browser ecosystem that have continued evolving, creating a widening gap between the threat model the software was designed for and the one it now operates in. If you're responsible for ATutor or a similar legacy LMS in production, the decision isn't really about patching — there's no patch coming. It's about whether running an abandoned platform with a known student-to-instructor privilege escalation path is acceptable organizational risk. For audit purposes, treat this as a fingerprint: the same client-side gating without API authorization pattern exists in OLAT, Sakai, Moodle forks, and dotProject derivatives. These systems warrant proactive review, not because of this specific CVE, but because the structural flaw that produced it is endemic to how that generation of academic software was built.

Reviewed through automated stages and approved by a human before publication.