CVE-2023-27485

thmmniii/fbs-core is an open source feedback system for students. In versions prior to 1.5.3 when querying `subresults`, it is possible to query `subresults` from other users due to insufficient authorisation. This is only possible for logged-in users and it is not possible to associate the subresults with a specific user. This bug was fixed in commit `f1ae67d8bb2`and released with version 1.5.3. Users are advised to upgrade. There are no known workarounds for this issue.

• CWE-863

• https://github.com/thm-mni-ii/feedbacksystem/commit/f1ae67d8bb2286a8eb15949038473d41b1358493Patch
• https://github.com/thm-mni-ii/feedbacksystem/releases/tag/v1.5.3Release Notes
• https://github.com/thm-mni-ii/feedbacksystem/security/advisories/GHSA-fhq8-p3w6-mmgrPatch, Third Party Advisory
• https://thm-mni-ii.github.io/feedbacksystem/api-docs/#tag/Submission/operation/getCourseTaskSubmissionSubresultsProduct
• https://github.com/thm-mni-ii/feedbacksystem/commit/f1ae67d8bb2286a8eb15949038473d41b1358493Patch
• https://github.com/thm-mni-ii/feedbacksystem/releases/tag/v1.5.3Release Notes
• https://github.com/thm-mni-ii/feedbacksystem/security/advisories/GHSA-fhq8-p3w6-mmgrPatch, Third Party Advisory
• https://thm-mni-ii.github.io/feedbacksystem/api-docs/#tag/Submission/operation/getCourseTaskSubmissionSubresultsProduct

Published

Mar 7, 2023

Last Modified

Jun 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-27479XWiki Platform is a generic wiki platform offering runtime s…9.9
• CVE-2023-27480XWiki Platform is a generic wiki platform offering runtime s…7.7
• CVE-2023-27481Directus is a real-time API and App dashboard for managing S…4.3
• CVE-2023-27482homeassistant is an open source home automation tool. A remo…10
• CVE-2023-27483crossplane-runtime is a set of go libraries used to build Ku…7.5
• CVE-2023-27484crossplane-runtime is a set of go libraries used to build Ku…4.9
• CVE-2023-27486xCAT is a toolkit for deployment and administration of compu…8.8
• CVE-2023-27487Envoy is an open source edge and service proxy designed for …9.1
• CVE-2023-27488Envoy is an open source edge and service proxy designed for …9.8
• CVE-2023-27489Kiwi TCMS is an open source test management system for both …5.4
• CVE-2023-2749Download Center fails to properly validate the file path sub…7.5
• CVE-2023-27490NextAuth.js is an open source authentication solution for Ne…8.8