EUVD-2026-103025
GHSA-c9xv-j5wf-2g29
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as any valid student
-
DeliveryRequest course/attachment endpoint directly
-
ExploitEnumerate sequential course and attachment IDs
-
ExecutionBypass omitted department visibility check
-
ImpactExfiltrate cross-department course data and attachment files
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Object-level authorization, IDOR prevention
|
| Exploitation Conditions | Exploitation requires a valid authenticated student account on the PlayEdu instance (PR:L) and reachability of the frontend CourseController's course-details and attachment-download endpoints. The specific precondition is that course/attachment objects are assigned department-based visibility restrictions that the student would not normally be entitled to see; the flaw is that CourseController omits the department visibility check on these endpoints. Limiting factors: the attacker must already hold credentials (not remote-unauthenticated), sequential/predictable course and attachment IDs must be enumerable, and impact is confined to reading course structure and attachment files - there is no integrity or availability impact and no privilege escalation to admin. |
| Impact | This is a medium-severity authorization flaw (CWE-639, IDOR-style missing authorization) in PlayEdu's CourseController, reported by VulnCheck with a vendor CVSS 4.0 base score of 5.3. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N) is internally consistent with the description: network-reachable, low complexity, requiring low privileges (PR:L - a legitimate authenticated student account), no user interaction, with limited confidentiality impact and no integrity or availability impact. No EPSS score, KEV listing, or SSVC decision point was supplied in the input, and no public exploit was identified at time of analysis. The signals are therefore consistent rather than conflicting, but all point to a moderate, data-confidentiality-only issue rather than a top-tier emergency: an authenticated insider (a student) can read course structure and download attachment files belonging to other departments by enumerating sequential IDs. The absence of KEV/EPSS data means real-world exploitation frequency is unknown; the low CVSS, confidentiality-only impact, and the requirement for a valid account all argue against widespread opportunistic exploitation. Priority should be driven by how sensitive the hosted course/attachment content is in a given deployment rather than by the raw score. |
| Exploit ScenarioDerived | A legitimate student logs into a PlayEdu instance and, instead of browsing only their own department's catalog, issues direct requests to the course details and attachment download endpoints while incrementing the course and attachment ID values. Because the department visibility check is omitted in CourseController, the server returns course structure and downloadable attachment files from departments the student should not see. No public exploit code was identified at time of analysis, but the enumeration is trivial to script against the documented endpoints. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 16, 2026
Missing department-level authorization in PlayEdu through 2.3 lets an authenticated student read course details and download attachment files that belong to departments the student is not entitled to see, because the frontend CourseController skips the department visibility check on those endpoints. The flaw is an IDOR-style (CWE-639) access-control gap: course and attachment identifiers are sequential and therefore enumerable, so a low-privileged account with valid credentials can walk the ID space and harvest course structure and files from other departments. Impact is confidentiality-only - no integrity or availability effect and no escalation to administrative privileges - and the vendor CVSS 4.0 base score of 5.3 (independent assessment CVSS 3.1: AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) reflects a medium-severity information-disclosure risk. Exploitation status: no public exploit identified at time of analysis; a public third-party technical write-up of the flaw has been published, and no CISA KEV listing has been associated with this CVE.
RemediationAI
No vendor-released patch version is identified in the available data; the references point to the vulnerable 2.3 source tree and the upstream repository rather than to a fix commit or tagged release, so patch status should be confirmed directly with the PlayEdu maintainers (https://github.com/PlayEdu/PlayEdu) and via the VulnCheck advisory (https://www.vulncheck.com/advisories/playedu-through-2.3-missing-authorization-via-student-coursecontroller-endpoints). Until a fixed version is published, the most effective control is to add the missing department-scoping check at the application layer - enforce that the requested course or attachment ID belongs to a department the authenticated student is a member of before returning the object, ideally in a shared authorization filter/interceptor so that every controller path inherits the check; the trade-off is that this requires a code change and re-deployment of the playedu-api module, and any endpoint missed by the interceptor remains exposed. If immediate patching is not feasible, restrict the frontend student role at the reverse proxy so that the attachment-download path (and course-details path) is only reachable from trusted networks or is temporarily disabled; this removes the data-exposure channel but also breaks legitimate course material downloads for all students. Replacing or supplementing sequential course and attachment identifiers with unguessable UUIDs reduces the enumerability of the ID space and raises the effort required to find other departments' objects, but it is a defense-in-depth measure only - it does not fix the missing authorization check and does not protect against an attacker who can guess or learn valid IDs. Finally, enable and review access logs on the CourseController endpoints for high-volume sequential ID patterns from student accounts to detect enumeration attempts, and audit department assignments on existing courses and attachments so that any already-accessed content can be identified; log review is detective rather than preventive and adds monitoring cost.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
PlayEdu is an open-source online training/e-learning platform whose backend is implemented in Java (Spring Boot) and split into modules, with the vulnerable code living in the playedu-api module's frontend-facing controller at playedu-api/src/main/java/xyz/playedu/api/controller/frontend/CourseController.java (lines ~57-132). The underlying weakness is CWE-639, Authorization Bypass Through User-Controlled Key: the course-details and attachment-download handlers accept a client-supplied numeric identifier and resolve the object directly from the datastore without applying PlayEdu's department-based visibility scoping. In the intended design, courses and their attachments are tagged to departments and are only surfaced to students whose department membership grants them access; because that check is simply absent from these two code paths (rather than misconfigured), the endpoint enforces authentication but not authorization. The impact is amplified by the use of sequential, predictable primary keys for courses and attachments, which turns the missing check into a practical enumeration primitive: an attacker iterates IDs, and every object that exists is returned regardless of department ownership. The CPE entry cpe:2.3:a:playedu:playedu:*:*:*:*:*:*:*:* carries a wildcard version, consistent with the advisory statement that all releases through 2.3 are affected. The CVSS 4.0 vector supplied by the vendor scores PR:L with VC:L, which aligns with the independent CVSS 3.1 assessment (PR:L, C:L, no I/A impact) - the vulnerability is reachable over the network by any holder of a valid student account, but requires that account and yields read-only exposure of cross-department content.
Know when Playedu gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Network-reachable endpoint abusable by any authenticated student (PR:L, AC:L, UI:N); only limited cross-department data disclosure, so C:L and I:A:N.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
DescriptionCVE.org
PlayEdu through 2.3 contains a missing authorization vulnerability in the CourseController that allows authenticated students to access department-restricted courses by omitting the department visibility check. Attackers can enumerate sequential course and attachment IDs via the course details and attachment download endpoints to obtain course structure and attachment files from other departments.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB