My.UChicago Vulnerability Could Have Exposed Students’ Class Schedules

My.UChicago Vulnerability Could Have Exposed Students’ Class Schedules

A few weeks into his first year in 2021, Andrei Thüler logged into my.UChicago to download his class schedule to add to his calendar. But something caught his eye: the download URL contained his student ID. At the time, it didn’t seem like an issue. It wasn’t until 2024—after taking several data science courses—that Thüler realized replacing his ID in the URL with another allowed access to other students’ class schedules without requiring additi…