Vulnerability · Published Sep 15, 2026 · Assigned by GitHub_M
CVE-2026-88065`tts-be` application has a Broken Access Control vulnerability
High 7.5
In plain English
A high-severity information exposure in tts-be from NIAEFEUP. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 44% of all known vulnerabilities).
Official description
`tts-be` is a backend for a timetable selector that aims to help students better choose their class schedules. Versions prior to 2.1.0 have a Broken Access Control vulnerability across several API endpoints (such as `/api/student/{id}/photo` and `/api/course_unit/{id}/exchange/metadata`). By chaining these unauthenticated endpoints, a remote attacker can use the backend as an open proxy to bypass authorization checks, allowing for the enumeration and extraction of sensitive Personally Identifiable Information (PII) from upstream university systems. The exposed data includes full names, student IDs, class schedules, and photos. This issue was fixed in version 2.1.0.
Affected products (as reported)
Weakness: CWE-200, CWE-306, CWE-639 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
References
- https://github.com/NIAEFEUP/tts-be/security/advisories/GHSA-fpfp-hr42-fvpm x_refsource_CONFIRM