# CVE-2026-64965: ATutor missing authorization check in test and question import

Source: https://junglewise.ai/threats/cve-2026-64965-atutor-missing-authorization-check-in-test-and-question-import  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-20. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-64965 · Severity: info · Published 2026-08-20

ATutor is a learning management system (LMS) used by educational institutions to deliver online courses and assessments. A vulnerability allows low-privileged students enrolled in a course to import tests and questions without proper authorization, potentially corrupting course content or inserting unauthorized assessment material that could affect course integrity and student grades.

Technologies: [ATutor](https://junglewise.ai/threats/technologies/atutor). Vendors: [ATutor](https://junglewise.ai/threats/vendors/atutor).

## Quick answers

**Is CVE-2026-64965 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-64965 being exploited in the wild.

**How severe is CVE-2026-64965?** Informational severity, published 20 August 2026.

**Which products and versions are affected?** ATutor 2.2.4.

**Is there a fix for CVE-2026-64965?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-64965 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-64965?** Check whether you run ATutor at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a missing authorization check (CWE-862) in the backend import endpoints for tests and questions. Low-privileged authenticated users (e.g., students) can bypass authorization controls by sending direct requests to these endpoints, allowing unauthorized import operations within a course. The attack requires an authenticated account and course enrollment but does not require instructor/administrator privileges. ATutor 2.2.4 is confirmed vulnerable; other versions are unknown. The product is no longer actively maintained and no patch is available.

## Affected products

- ATutor ATutor 2.2.4

## Timeline

- 2026-08-20: disclosed

## References

- [https://atutor.github.io/](https://atutor.github.io/)
- [https://cert.pl/en/posts/2026/08/CVE-2026-64960](https://cert.pl/en/posts/2026/08/CVE-2026-64960)

## Related threats

- [ATutor reflected XSS in preview.php popup parameter](https://junglewise.ai/threats/cve-2026-64972-atutor-reflected-xss-in-preview-php-popup-parameter)
- [ATutor reflected XSS in restore functionality](https://junglewise.ai/threats/cve-2026-64971-atutor-reflected-xss-in-restore-functionality)
- [ATutor stored cross-site scripting in user profile](https://junglewise.ai/threats/cve-2026-64970-atutor-stored-cross-site-scripting-in-user-profile)
- [ATutor IDOR in profile picture endpoints](https://junglewise.ai/threats/cve-2026-64969-atutor-idor-in-profile-picture-endpoints)
- [ATutor server-side request forgery in import functionality](https://junglewise.ai/threats/cve-2026-64968-atutor-server-side-request-forgery-in-import-functionality)