CVE-2026-14187

Name of the Vulnerable Software and Affected Versions Tutor LMS versions prior to 4.0.6

Description The plugin fails to enforce per-object ownership checks on its course content type. This allows users with the instructor role to access and read the content of private courses created by other instructors through an Insecure Direct Object Reference (IDOR), which occurs when an application provides direct access to objects based on user-supplied input without sufficient authorization checks.

Recommendations Update to version 4.0.6 or later.