Scoold CVE-2026-39354

This vulnerability presents moderate real-world risk with high integrity impact. The CVSS 6.5 score reflects the requirement for prior authentication (PR:L) but captures the complete loss of confidentiality control over question content. EPSS signals are unavailable, but the attack vector (AV:N) and low complexity (AC:L) indicate minimal barriers to exploitation. The lack of reported active exploitation (no CISA KEV or public POC noted in input data) suggests this may be pre-disclosure or post-patch publication analysis. However, the authorization bypass is trivial to exploit once discovered: any low-privilege user can systematically target high-value or sensitive questions from competitors, moderators, or content creators. Unlike high-CVSS vulnerabilities requiring complex exploitation chains, this flaw requires only valid credentials and URL manipulation, making remediation urgency high despite the moderate score. Organizations heavily dependent on question integrity (internal knowledge bases, compliance documentation) face greater risk.

An attacker with a low-privilege Scoold account identifies a high-visibility question (e.g., a critical knowledge-base entry or a competitor's technical documentation) by viewing it on the public platform, copying its question ID from the URL. The attacker then submits a POST request to POST /questions/ask with the copied question ID as postId, replacing the legitimate content with false information, spam, or promotional material. Because the request is authenticated and the authorization check is missing, the platform accepts the overwrite, and the corrupted question now appears under the original author's name, damaging credibility and confusing readers who relied on the original answer.