CVE-2026-110465 WisdomGarden CVE debrief

Who should care

Defenders of Tronclass deployments, particularly those with student peer review functionality, should assess exposure and prioritize patching or mitigating this vulnerability to prevent potential data integrity issues and compromised student assessments. Defenders should also verify authentication and authorization mechanisms for peer review score modifications and monitor for suspicious activity related to peer review score alterations.

Why it matters

CVE-2026-110465 is a medium-severity vulnerability in Tronclass that allows authenticated remote attackers to modify peer review scores. Defenders of Tronclass deployments should assess exposure and prioritize patching or mitigating this vulnerability to prevent potential data integrity issues and compromised student assessments.

• Modification of peer review scores by authenticated remote attackers
• Potential for data integrity issues and compromised student assessments

Technical summary

Tronclass developed by WisdomGarden has an Insecure Direct Object Reference vulnerability. Authenticated remote attackers can modify a specific parameter to alter the peer review scores of any student. This vulnerability affects Tronclass deployments with student peer review functionality. Defenders should assess exposure and prioritize patching or mitigating this vulnerability to prevent potential data integrity issues and compromised student assessments. The vulnerability is confirmed by official CVE Program record and NVD vulnerability detail page.

Defensive priority

Medium priority for defenders of Tronclass deployments

Recommended defensive actions

• Review and update Tronclass deployments to ensure affected versions are patched
• Verify authentication and authorization mechanisms for peer review score modifications
• Monitor for suspicious activity related to peer review score alterations
• Perform a thorough review of Tronclass configurations to identify potential exposure
• Implement compensating controls for exposed systems while remediation is scheduled and verified
• Track exceptions and retest remediated assets to ensure the vulnerability is properly addressed
• Review relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

Official CVE Program record and NVD vulnerability detail page confirm Insecure Direct Object Reference vulnerability in Tronclass. Vendor WisdomGarden and affected product versions are identified. The vulnerability allows authenticated remote attackers to modify a specific parameter to alter the peer review scores of any student. Defenders should verify authentication and authorization mechanisms for peer review score modifications and monitor for suspicious activity related to peer review score alterations.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.