Executive brief
tts-be is a backend service used by students to select their class schedules at universities. The application prior to version 2.1.0 lacks proper authentication and authorization checks on several API endpoints, allowing unauthenticated attackers to retrieve sensitive student data such as full names, IDs, class schedules, and photos. By chaining these endpoints, attackers can extract Personally Identifiable Information (PII) from the upstream university systems, creating a significant privacy and confidentiality breach.
Technical details
The vulnerability is a broken access control issue (CWE-200, CWE-306, CWE-639) affecting API endpoints such as `/api/student/{id}/photo` and `/api/course_unit/{id}/exchange/metadata`. The root cause is an architectural flaw where the backend's proxy mechanism lacked a global authentication and authorization layer for upstream requests. An unauthenticated remote attacker can exploit this over the network (no privileges or user interaction required) by chaining these endpoints to bypass authorization checks and extract PII from upstream university systems. The vulnerability was patched in version 2.1.0 through a unified implementation of access controls across the API routing layer.
Affected products
- NIAEFEUP tts-be prior to 2.1.0
Timeline
- 2026-05-17: disclosed: GitHub Security Advisory published
- 2026-05-17: patched: Version 2.1.0 released with fix
- 2026-09-15: advisory: NVD entry published as CVE-2026-88065