CVE-2026-3371

Name of the Vulnerable Software and Affected Versions Tutor LMS versions prior to 3.9.8

Description An Insecure Direct Object Reference exists due to missing authorization checks in the save course content order() private method. This method is called unconditionally by the tutor update course content order AJAX handler. Although a can user manage() check is present in the content parent branch of the handler, the save course content order() call processes the tutor topics lessons sorting JSON variable without verifying ownership or capabilities. Consequently, authenticated users with Subscriber-level access or higher can detach lessons from topics, reorder course content, and reassign lessons between topics in any course, including those owned by administrators, by sending a crafted AJAX request with manipulated topic and lesson IDs.

Recommendations Update to version 3.9.8 or later.