Insecure Direct Object Reference in Tutor LMS Course Bulk Actions

Tutor LMS up to 3.9.5 does not check course ownership in the course list bulk action (tutor_course_list_bulk_action). An authenticated user with Tutor Instructor access can publish, unpublish, trash or permanently delete courses owned by other instructors by submitting their course IDs. In 2.0.0-2.1.8 the action has no role check at all, so any logged-in user can do the same.

This vulnerability affects the following application versions:

• Tutor LMS – eLearning and online course solution 2.0.0
• Tutor LMS – eLearning and online course solution 2.0.1
• Tutor LMS – eLearning and online course solution 2.0.2
• Tutor LMS – eLearning and online course solution 2.0.3
• Tutor LMS – eLearning and online course solution 2.0.4
• Tutor LMS – eLearning and online course solution 2.0.5
• Tutor LMS – eLearning and online course solution 2.0.6
• Tutor LMS – eLearning and online course solution 2.0.7
• Tutor LMS – eLearning and online course solution 2.0.8
• Tutor LMS – eLearning and online course solution 2.0.9
• Tutor LMS – eLearning and online course solution 2.0.10
• Tutor LMS – eLearning and online course solution 2.1.0
• Tutor LMS – eLearning and online course solution 2.1.1
• Tutor LMS – eLearning and online course solution 2.1.2
• Tutor LMS – eLearning and online course solution 2.1.3
• Tutor LMS – eLearning and online course solution 2.1.4
• Tutor LMS – eLearning and online course solution 2.1.5
• Tutor LMS – eLearning and online course solution 2.1.6
• Tutor LMS – eLearning and online course solution 2.1.7
• Tutor LMS – eLearning and online course solution 2.1.8
• Tutor LMS – eLearning and online course solution 2.7.3
• Tutor LMS – eLearning and online course solution 2.7.4
• Tutor LMS – eLearning and online course solution 2.7.5
• Tutor LMS – eLearning and online course solution 2.7.6
• Tutor LMS – eLearning and online course solution 2.7.7
• Tutor LMS – eLearning and online course solution 3.0.0
• Tutor LMS – eLearning and online course solution 3.0.1
• Tutor LMS – eLearning and online course solution 3.0.2
• Tutor LMS – eLearning and online course solution 3.1.0
• Tutor LMS – eLearning and online course solution 3.2.0
• Tutor LMS – eLearning and online course solution 3.2.1
• Tutor LMS – eLearning and online course solution 3.2.2
• Tutor LMS – eLearning and online course solution 3.2.3
• Tutor LMS – eLearning and online course solution 3.3.0
• Tutor LMS – eLearning and online course solution 3.3.1
• Tutor LMS – eLearning and online course solution 3.4.0
• Tutor LMS – eLearning and online course solution 3.4.1
• Tutor LMS – eLearning and online course solution 3.4.2
• Tutor LMS – eLearning and online course solution 3.5.0
• Tutor LMS – eLearning and online course solution 3.6.0
• Tutor LMS – eLearning and online course solution 3.6.1
• Tutor LMS – eLearning and online course solution 3.6.2
• Tutor LMS – eLearning and online course solution 3.6.3
• Tutor LMS – eLearning and online course solution 3.6.4
• Tutor LMS – eLearning and online course solution 3.7.0
• Tutor LMS – eLearning and online course solution 3.7.1
• Tutor LMS – eLearning and online course solution 3.7.2
• Tutor LMS – eLearning and online course solution 3.7.3
• Tutor LMS – eLearning and online course solution 3.7.4
• Tutor LMS – eLearning and online course solution 3.8.0
• Tutor LMS – eLearning and online course solution 3.8.1
• Tutor LMS – eLearning and online course solution 3.8.2
• Tutor LMS – eLearning and online course solution 3.8.3
• Tutor LMS – eLearning and online course solution 3.9.0
• Tutor LMS – eLearning and online course solution 3.9.1
• Tutor LMS – eLearning and online course solution 3.9.2
• Tutor LMS – eLearning and online course solution 3.9.3
• Tutor LMS – eLearning and online course solution 3.9.4
• Tutor LMS – eLearning and online course solution 3.9.5