CVE-2026-110467 WisdomGarden CVE debrief

Who should care

System administrators and security teams responsible for deploying and managing the Tronclass application should assess their exposure to this vulnerability and take necessary actions to mitigate it.

Why it matters

CVE-2026-110467 is a medium-severity vulnerability in WisdomGarden's Tronclass application that allows authenticated attackers to access sensitive student data. System administrators and security teams should assess their exposure, verify versions, and update or implement necessary controls to prevent exploitation.

• Authenticated attackers can access sensitive student data
• Potential data breaches or unauthorized access to student information
• Need to verify and update Tronclass versions to prevent exploitation
• Requires review of authentication and authorization mechanisms

Technical summary

The Tronclass application developed by WisdomGarden has an Insecure Direct Object Reference (IDOR) vulnerability. This vulnerability allows an authenticated remote attacker to modify a specific parameter and access the peer review scores of any student. The vulnerability has a CVSS score of 5.3, indicating a medium severity level. The affected product deployments should be assessed for exposure, and necessary controls should be implemented to prevent exploitation. The vulnerability can be mitigated by reviewing and validating user input, implementing proper authorization and access controls, monitoring and auditing authentication and authorization events, and updating Tronclass to a version that addresses the

Defensive priority

Medium priority for authentication and input validation

Recommended defensive actions

• Review and validate user input to prevent unauthorized access
• Implement proper authorization and access controls for sensitive data
• Monitor and audit authentication and authorization events
• Update Tronclass to a version that addresses the vulnerability, if available
• Perform a thorough review of system logs to detect potential exploitation attempts
• Conduct a comprehensive asset inventory to identify exposed systems
• Establish a rollback change window for remediation

Evidence notes

The CVE record and source item provide details on the Insecure Direct Object Reference vulnerability in WisdomGarden's Tronclass. Authenticated remote attackers can modify a specific parameter to view peer review scores of any student. The CVSS score is 5.3 (Medium).

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.