CVE-2026-88065: tts-be Backend Auth Bypass Vulnerability

CVE-2026-88065 Overview

CVE-2026-88065 is a Broken Access Control vulnerability in tts-be, an open-source backend for a university timetable selector maintained by NIAEFEUP. Versions prior to 2.1.0 expose several unauthenticated API endpoints, including /api/student/{id}/photo and /api/course_unit/{id}/exchange/metadata. Remote attackers can chain these endpoints to use the backend as an open proxy, bypassing authorization checks on upstream university systems. The exposed data includes full names, student IDs, class schedules, and photos. The issue is classified under CWE-200: Exposure of Sensitive Information to an Unauthorized Actor and is fixed in version 2.1.0.

Critical Impact
Unauthenticated remote attackers can enumerate and extract Personally Identifiable Information (PII) — including names, student IDs, schedules, and photos — from upstream university systems.

Affected Products

NIAEFEUP tts-be versions prior to 2.1.0
Upstream university identity and scheduling systems reachable through the backend
Deployments exposing tts-be API endpoints to untrusted networks

Discovery Timeline

2026-09-15 - CVE-2026-88065 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-88065

Vulnerability Analysis

The tts-be backend acts as an intermediary between a student-facing timetable client and upstream university systems that hold authoritative identity, enrollment, and scheduling data. Several API routes in versions prior to 2.1.0 do not enforce authentication or per-object authorization before relaying requests upstream. Endpoints such as /api/student/{id}/photo and /api/course_unit/{id}/exchange/metadata accept arbitrary identifiers and return responses derived from upstream lookups. An attacker iterates the {id} parameter to enumerate students and course units, extracting full names, student IDs, class schedules, and photographs. Chaining multiple endpoints turns the backend into an open proxy that laundering-launders requests through a trusted service account, defeating access controls the upstream systems would otherwise impose on direct callers.

Root Cause

The root cause is missing authentication and missing authorization on API routes that proxy sensitive data. The backend trusts the caller to only request identifiers they own, but does not tie requests to an authenticated session or verify that the requester is entitled to view records for the supplied {id}. This aligns with [CWE-200] and the Broken Access Control weakness class.

Attack Vector

Exploitation is remote, unauthenticated, and requires no user interaction. An attacker sends HTTP requests directly to the exposed tts-be endpoints, iterating numeric or string identifiers. Because the backend performs the upstream lookup with its own credentials, the attacker inherits that trust boundary. No exploit code is required beyond a scripted enumeration loop against the vulnerable endpoints. See the GitHub Security Advisory GHSA-fpfp-hr42-fvpm for the vendor's technical description.

Detection Methods for CVE-2026-88065

Indicators of Compromise

High-volume sequential requests to /api/student/{id}/photo or /api/course_unit/{id}/exchange/metadata from a single source IP
Unauthenticated requests to tts-be endpoints that produce successful 200 OK responses containing PII fields
Outbound requests from the tts-be service account to upstream university systems that do not correlate to legitimate session activity

Detection Strategies

Deploy request-rate and identifier-enumeration heuristics on the reverse proxy or WAF in front of tts-be
Log and alert on responses larger than expected baselines for the affected endpoints
Correlate backend-to-upstream API calls with authenticated frontend session activity to detect proxy abuse

Monitoring Recommendations

Ingest tts-be access logs and upstream API audit logs into a centralized analytics platform for correlation
Monitor for spikes in unique {id} values requested per source IP within short time windows
Track error-to-success ratios on the affected endpoints, since enumeration typically produces both hits and misses

How to Mitigate CVE-2026-88065

Immediate Actions Required

Upgrade tts-be to version 2.1.0 or later, which contains the fix
Restrict network access to the tts-be API to authenticated frontend origins until patched
Rotate any service credentials used by tts-be to reach upstream university systems if abuse is suspected

Patch Information

The vulnerability is fixed in tts-be version 2.1.0. Refer to the GitHub Security Advisory GHSA-fpfp-hr42-fvpm for the upstream commit references and release notes.

Workarounds

Place tts-be behind an authenticating reverse proxy that requires a valid university session cookie or token before forwarding requests
Apply rate limiting and per-source enumeration thresholds on the affected endpoints
Temporarily disable or block the /api/student/{id}/photo and /api/course_unit/{id}/exchange/metadata routes at the ingress layer until the upgrade is complete

bash

# Configuration example: block vulnerable endpoints at the reverse proxy
# NGINX snippet — deny access to the affected routes until tts-be is upgraded
location ~ ^/api/student/[^/]+/photo$ {
    return 403;
}
location ~ ^/api/course_unit/[^/]+/exchange/metadata$ {
    return 403;
}