Bug in student admissions website exposed children’s personal information

A security lapse in Ravenna Hub, an admissions platform handling applications for over a million students, allowed any logged-in user to view other students' profiles by changing sequential student ID numbers (an IDOR vulnerability). The flaw exposed sensitive PII — including children's names, dates of birth, addresses, photos, and parents' contact details — across approximately 1.63 million prior records; VenturEd patched the issue after being notified but has not confirmed user notification or whether any improper access occurred.