Read the docs
TI-2026-73881 Aliases CVE-2026-110466GHSA-277v-q825-2xgx

Sensitive data exposure in WisdomGarden Tronclass

Priority LOW 24CWE-497Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Information disclosure
Confidentiality · integrity · availability
Low · None · None
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-497.

Summary

WisdomGarden Tronclass from 1.77 and from 1.78 is affected. The flaw exposes sensitive information to an unauthorized party (CWE-497), so an authenticated remote attacker with low privileges can bypass anonymous grading restrictions and obtain anonymous student information. The attack needs no user interaction.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

Tronclass developed by WisdomGarden has a Sensitive Data Exposure vulnerability. Authenticated remote attackers can bypass anonymous grading restrictions and obtain anonymous student information.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00318 24th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
WisdomGardenTronclass1.77; 1.78—No fix listedCNA
  • Tronclass VendorWisdomGarden Affected 1.77; 1.78 Fixed in — No fix listed CNA

Remediation

The sources list no fixed version for Tronclass.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Timeline

  1. 2026-10-14 Threatist record created from CVE-2026-110466
  2. 2026-10-14 Alias added: GHSA-277v-q825-2xgx
  3. 2026-10-15 CISA SSVC decision points changed

References

Advisory 2

  • TI-2023-21953 WisdomGarden Tronclass ilearn - Path Traversal CVSS 3.1MEDIUM 6.5
  • TI-2024-06245 WisdomGarden Tronclass - Broken Access Control CVSS 3.1MEDIUM 5.3
  • TI-2023-10334 WisdomGarden Tronclass ilearn - Broken Access Control CVSS 3.1MEDIUM 6.5
  • TI-2026-02586 WisdomGarden｜Tronclass - Insecure Direct Object Reference CVSS 4.0MEDIUM 6.5
  • TI-2026-73882 Insecure direct object reference in WisdomGarden Tronclass CVSS 4.0MEDIUM 5.3
  • TI-2026-73880 Insecure direct object reference in WisdomGarden Tronclass CVSS 4.0MEDIUM 5.3
See all 7 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences