LearnHouse CVE-2025-12269

Exploitation requires three specific conditions: (1) Valid LearnHouse user account credentials (PR:L in CVSS vector confirms authentication is required); (2) Access to the Account Setting Page and specifically the /dash/org/settings/previews endpoint with ability to modify settings; (3) A second authenticated user or administrator must view the attacker's settings page (UI:P - user interaction is required). The vulnerability does not execute automatically upon account creation or for unauthenticated users. Deployments with restricted account creation (limiting who can obtain credentials) or limited access to Account Settings reduce practical risk. The rolling-release model means no specific 'vulnerable configuration' applies; rather, all current and legacy instances without code-level mitigation are affected.

Despite the CVSS 4.0 score of 2.0 and extremely low EPSS percentile (7%, suggesting minimal real-world exploitation probability), multiple risk factors warrant attention: the vulnerability requires authentication (PR:L) and user interaction (UI:P), which significantly constrains practical exploitability beyond insider threats; the integrity impact is low (VI:L) rather than critical; and the EPSS score of 0.03% suggests very limited automated exploitation potential. However, the public exploit code availability and the vendor's non-response to early disclosure are concerning signals. The low CVSS and EPSS scores appear proportionate to the actual risk - this is not a high-severity vulnerability misclassified as low, but rather a legitimate low-priority issue driven by strong mitigating factors (authentication, user interaction). Organizations relying on LearnHouse should address this during normal patching cycles rather than emergency response, though it may be relevant for insider threat scenarios or multi-stage attacks.

An authenticated attacker with low-privilege access to LearnHouse crafts a malicious account settings update containing JavaScript code (e.g., a keylogger or session stealer) in the /dash/org/settings/previews field. When another user, such as an instructor or administrator, views the attacker's account settings page, the malicious script executes in their browser with their privileges, potentially harvesting credentials or modifying content without their knowledge. The attack requires the attacker to already have valid credentials and the victim to interact with the settings page, limiting opportunistic exploitation.