Tutor LMS up to 3.9.5 does not check course ownership in the course list bulk action (tutor_course_list_bulk_action). An authenticated user with Tutor Instructor access can publish, unpublish, trash or permanently delete courses owned by other instructors by submitting their course IDs. In 2.0.0-2.1.8 the action has no role check at all, so any logged-in user can do the same.
This vulnerability affects the following application versions:
- Tutor LMS – eLearning and online course solution 2.0.0
- Tutor LMS – eLearning and online course solution 2.0.1
- Tutor LMS – eLearning and online course solution 2.0.2
- Tutor LMS – eLearning and online course solution 2.0.3
- Tutor LMS – eLearning and online course solution 2.0.4
- Tutor LMS – eLearning and online course solution 2.0.5
- Tutor LMS – eLearning and online course solution 2.0.6
- Tutor LMS – eLearning and online course solution 2.0.7
- Tutor LMS – eLearning and online course solution 2.0.8
- Tutor LMS – eLearning and online course solution 2.0.9
- Tutor LMS – eLearning and online course solution 2.0.10
- Tutor LMS – eLearning and online course solution 2.1.0
- Tutor LMS – eLearning and online course solution 2.1.1
- Tutor LMS – eLearning and online course solution 2.1.2
- Tutor LMS – eLearning and online course solution 2.1.3
- Tutor LMS – eLearning and online course solution 2.1.4
- Tutor LMS – eLearning and online course solution 2.1.5
- Tutor LMS – eLearning and online course solution 2.1.6
- Tutor LMS – eLearning and online course solution 2.1.7
- Tutor LMS – eLearning and online course solution 2.1.8
- Tutor LMS – eLearning and online course solution 2.7.3
- Tutor LMS – eLearning and online course solution 2.7.4
- Tutor LMS – eLearning and online course solution 2.7.5
- Tutor LMS – eLearning and online course solution 2.7.6
- Tutor LMS – eLearning and online course solution 2.7.7
- Tutor LMS – eLearning and online course solution 3.0.0
- Tutor LMS – eLearning and online course solution 3.0.1
- Tutor LMS – eLearning and online course solution 3.0.2
- Tutor LMS – eLearning and online course solution 3.1.0
- Tutor LMS – eLearning and online course solution 3.2.0
- Tutor LMS – eLearning and online course solution 3.2.1
- Tutor LMS – eLearning and online course solution 3.2.2
- Tutor LMS – eLearning and online course solution 3.2.3
- Tutor LMS – eLearning and online course solution 3.3.0
- Tutor LMS – eLearning and online course solution 3.3.1
- Tutor LMS – eLearning and online course solution 3.4.0
- Tutor LMS – eLearning and online course solution 3.4.1
- Tutor LMS – eLearning and online course solution 3.4.2
- Tutor LMS – eLearning and online course solution 3.5.0
- Tutor LMS – eLearning and online course solution 3.6.0
- Tutor LMS – eLearning and online course solution 3.6.1
- Tutor LMS – eLearning and online course solution 3.6.2
- Tutor LMS – eLearning and online course solution 3.6.3
- Tutor LMS – eLearning and online course solution 3.6.4
- Tutor LMS – eLearning and online course solution 3.7.0
- Tutor LMS – eLearning and online course solution 3.7.1
- Tutor LMS – eLearning and online course solution 3.7.2
- Tutor LMS – eLearning and online course solution 3.7.3
- Tutor LMS – eLearning and online course solution 3.7.4
- Tutor LMS – eLearning and online course solution 3.8.0
- Tutor LMS – eLearning and online course solution 3.8.1
- Tutor LMS – eLearning and online course solution 3.8.2
- Tutor LMS – eLearning and online course solution 3.8.3
- Tutor LMS – eLearning and online course solution 3.9.0
- Tutor LMS – eLearning and online course solution 3.9.1
- Tutor LMS – eLearning and online course solution 3.9.2
- Tutor LMS – eLearning and online course solution 3.9.3
- Tutor LMS – eLearning and online course solution 3.9.4
- Tutor LMS – eLearning and online course solution 3.9.5