`tts-be` application has a Broken Access Control vulnerability

published 2026-09-15 54 d ago modified 2026-09-30 39 d ago also EUVD-2026-79943

cvss: 7.5; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.5%; EPSS 0.5% chance of exploitation in 30 days, percentile 43%
public exploits: 0; none known

`tts-be` is a backend for a timetable selector that aims to help students better choose their class schedules. Versions prior to 2.1.0 have a Broken Access Control vulnerability across several API endpoints (such as `/api/student/{id}/photo` and `/api/course_unit/{id}/exchange/metadata`). By chaining these unauthenticated endpoints, a remote attacker can use the backend as an open proxy to bypass authorization checks, allowing for the enumeration and extraction of sensitive Personally Identifiable Information (PII) from upstream university systems. The exposed data includes full names, student IDs, class schedules, and photos. This issue was fixed in version 2.1.0.

CISA SSVC

Exploitation: none
Automatable: yes
Technical impact: partial
Assessed: 54 d ago (2026-09-16)

Exploit prediction

0.51% chance of exploitation in the next 30 days, higher than 43% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	3.1	7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Affected products

NIAEFEUP tts-be

Classification

Weakness

CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
CWE-306 Missing Authentication for Critical Functionality
CWE-639 Authorization Bypass Through User-Controlled Key

References

github.com /NIAEFEUP/tts-be/security/advisories/GHSA-fpfp-hr42-fvpm

Sources

CVE List CVE-2026-88065
NVD CVE-2026-88065

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary