I looked at ACS Future School security for a few hours. It did not go well.

I was not trying to hack anyone.

I got curious about ACS Future School a few days ago and started poking around the way I normally do when I am learning. Just the login flow, the dashboard, the API responses in the browser. Normal stuff.

It got uncomfortable pretty fast.

I found login flows that accept weak numeric PINs. I found responses that leak data between accounts, where you log in as one user and see another user's profile. I found sales records with personal details that should never be visible without a proper session. I even found a PIN change issue that let me get into an affiliate dashboard that was not mine. I stopped there because it felt wrong to keep going.

This is what a login response looks like. I blacked out the phone number, the name, and the session token. The point is how much the API hands back on a normal login.

This is the part that bothered me most. I logged in with one phone number and PIN, and the active profile endpoint returned a completely different person's account. Three tries, three mismatches. Phone numbers and names are blacked out, but the IDs are left in so you can see they do not match.

Once inside an affiliate dashboard, pages like this sales overview load without a fight. This is the kind of internal data that should sit behind solid access control.

And this is the profile section of that dashboard. I cropped out the right side because it showed the account holder's personal details.

Look, I am not writing this to dunk on ACS. I am writing it because this platform holds data for students and parents. Real names, phone numbers, payment related info. That kind of data in the wrong hands means spam and fraud for ordinary families.

A note on the screenshots: every name, phone number, email, and token in them is blacked out or cropped out. I am not posting exploit steps either. If anyone from the ACS tech team is reading this, reach out. I will share the full technical details privately so you can reproduce and fix it.

I really hope they fix this fast. Student privacy should be basic, not optional.