Skillable SCORM CVE-2026-56877
MEDIUMSeverity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
PR:L for required enrollment token; C:L and I:L added over the reporter's score to reflect vendor-confirmed session exposure and allocation integrity bypass.
Primary rating from Vendor (CNA).
CVSS VectorVendor
Lifecycle Timeline
2Description PRE-NVD
AnalysisAI
Skillable's hosted SCORM lab launch endpoint at scorm.skillable.com enforces per-user lab allocation limits against a client-supplied userId query parameter that is never validated against the authenticated SCORM session token, enabling any enrolled learner to bypass rate limits, provision concurrent cloud VM lab instances at the course provider's expense, and exhaust another enrolled user's lab or exam allocation to deny them access. The vulnerability (CWE-639) was confirmed against the reporter's own account and a consenting fellow student on 2026-05-03; the vendor subsequently acknowledged in a private customer advisory that exam allocations and another learner's active session details are also reachable via the same mechanism. No fix is planned for the SCORM launch path; the vendor characterises the weakness as an inherent SCORM limitation and recommends migration to API or LTI 1.3 integrations. No public exploit code has been released, but the attack technique is trivially reproducible by any enrolled student with a proxy.
Technical ContextAI
The vulnerability affects Skillable's (formerly Learn on Demand Systems) hosted SCORM (Sharable Content Object Reference Model) lab provisioning service. SCORM is a client-driven e-learning standard: when a learner opens a lab unit, the LMS (demonstrated via LearnWorlds) constructs a launch URL containing both a SCORM token and a userId query parameter, then requests it from scorm.skillable.com. The server validates the SCORM token to confirm enrollment authorization but evaluates the per-user launch allocation limit against the browser-supplied userId rather than against an identity derived from the validated token - a textbook instance of CWE-639 (Authorization Bypass Through User-Controlled Key), where the authorization decision is made against a key the client controls rather than a server-validated principal. Critically, the SCORM token and the userId are entirely decoupled: the same token accepted arbitrary userId values including non-hexadecimal strings ('683175c1ac36b0299c24b31g') and fully fabricated identifiers ('000000000000000000000001'), each provisioning a separate LabInstanceId. The token did not change across launches under different userId values, confirming no user-specific binding exists. Each lab instance typically provisions a domain controller plus one to three additional virtual machines for 30 to 60 minutes. No CPE strings are applicable as this is a hosted SaaS service with no discrete versioning.
Affected ProductsAI
Skillable (formerly Learn on Demand Systems) hosted SCORM lab provisioning service, specifically the GET /scorm/launch endpoint at scorm.skillable.com and its userId query parameter. The service is SaaS-hosted with no discrete version identifiers or commit hashes. Exploitation was confirmed during researcher testing on 2026-04-28 (rate-limit bypass) and 2026-05-03 (cross-user DoS against a consenting fellow student) and was subsequently acknowledged by Skillable (support ticket #4043837, Nat Shere, Manager, Product Security). The vendor's private customer advisory further confirmed that the same mechanism affects exam allocation paths. All Skillable customers using the SCORM launch integration are affected; customers using the API or LTI 1.3 launch integrations are not affected. No patch has been issued and none is planned. Disclosure and vendor advisory details are available at https://seclists.org/oss-sec/2026/q3/120 and https://payloadforge.io/beyond-crto-skillable/.
RemediationAI
No server-side patch exists and the vendor has confirmed none is planned for the SCORM launch path. The only complete remediation is migration from the SCORM launch integration to Skillable's API or LTI 1.3 launch integration, both of which bind learner identity server-side and eliminate the client-controlled userId problem; the vendor has issued a private migration advisory to affected customers to this effect. Course providers still on the SCORM path should, as interim compensating controls, request that Skillable disable SCORM launch access for their tenant and enforce enrollment exclusively via LTI 1.3; this removes the vulnerable endpoint from the attack surface entirely but requires LMS-side reconfiguration. Monitoring LabInstanceId proliferation per SCORM token and setting cost-based alerting on cloud VM provisioning may limit financial impact but will not prevent exploitation. Restricting the LMS learner enumeration endpoint that exposes other enrolled users' userId values will limit the scalability of cross-user attacks without eliminating rate-limit bypass or concurrent-instance abuse, which require only the attacker's own token. No advisory URLs for a vendor-published patch exist because no patch was released; see https://seclists.org/oss-sec/2026/q3/120 for full disclosure details.
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today