CVE-2026-64969: ATutor is vulnerable to Insecure Direct Object Reference (IDOR) attack in profile picture related endpoints. Any authent

ATutor has a security flaw called IDOR (insecure direct object reference, where an attacker can access or modify resources by guessing or changing ID numbers) in its profile picture feature. Any logged-in user can delete another user's profile picture by sending a request with someone else's member ID, even if that person is an instructor or administrator.