> JapanHacked_
[Resolved][Severity: Moderate][Misconfiguration]

Saitama University: a misconfigured GPA distribution tool left a list of student numbers and GPAs of 8,373 enrolled students viewable

A misconfigured tool publishing GPA distributions to students and parents showed a list of student numbers and GPAs after a specific screen operation.

Disclosed

2025-12-15

Organizations involved

1

Leaked or at risk

Unknown

Downtime

Unknown

What happened

  1. A student pointed out that the GPA distribution published through a data visualization tool displayed a list of student numbers and GPAs after a specific screen operation. The university stopped the publication immediately. [1] [2]

  2. It announced that student personal information had been viewable. [1] [2]

Impact

The university had published GPA distributions to students and their parents to visualize learning progress. A flaw in the data source settings exposed the list of student numbers and GPAs that should have stayed private. The list covers 8,373 enrolled students. [1] [2]

Timeline

  1. Detected 2025-11-18
  2. Disclosed 2025-12-15
  3. 27 days

Attack or cause

Method
[Misconfiguration]
Impact
[Data leak]
Entry point
Unknown

Data exposed or at risk

[Education]

Organizations involved

Open in organization search

Sources

  1. [1][Official]本学学生の個人情報(学籍番号及びGPA等)が閲覧可能状態にあったことについて(お詫び)Saitama University · 2025-12-15
  2. [2][News]埼玉大学で在学生 8,373 名の学籍番号及び GPA 等を含む個人情報が閲覧可能にScanNetSecurity · 2026-01-07 08:05