CVE-2026-82849

Name of the Vulnerable Software and Affected Versions Masteriyo LMS versions prior to 3.4.2

Description An Insecure Direct Object Reference (IDOR) exists where the software fails to verify if the authenticated user requesting course-progress records is the actual owner of those records. This allows any authenticated user, including self-registered subscribers, to access the learning activity of other users. Furthermore, if the requested account is not specified with a non-zero value, the system skips the ownership check entirely and returns the progress records of all learners on the site.

Recommendations Update Masteriyo LMS to version 3.4.2 or later.