Executive brief
A vulnerability exists in stumasy, a student management and social networking platform. An unauthorized person can remotely view, change, or delete student assignment answers and personal notes without needing a password. This could lead to the theft of student work, falsification of academic records, and loss of private data.
Technical details
The vulnerability is an Insecure Direct Object Reference (IDOR) located in the Note and Assignment Handlers of the stumasy student management system. Specifically, endpoints such as update_assignment_answer.php and update_scratch_data.php accept record IDs (e.g., assignment_item_id, scratch_data_id) via POST requests without verifying user authentication or record ownership. An unauthenticated remote attacker can exploit this by supplying arbitrary IDs to perform unauthorized CRUD operations on the database. The root cause is the lack of session validation and ownership checks in the Notes_controller class. As of the advisory date, the project has not responded to the issue report, and no patch is available.
Affected products
- mjperpinosa stumasy up to 327d1b0f2915ba79d7ef8ebb74553e987609d9be
Timeline
- 2026-06-05: disclosed: Issue reported to the developer via GitHub
- 2026-07-05: advisory: CVE published to NVD dataset