EUVD-2026-50135
GHSA-9ch9-66pf-cjcf
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Low-privilege authentication required, network accessible, low complexity, and limited confidentiality impact only.
Primary rating from Vendor (CSA).
CVSS VectorVendor: CSA
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Lifecycle Timeline
1DescriptionCVE.org
An information disclosure vulnerability in Koollab LMS allowed an authenticated learner to obtain correct quiz answers from the course status endpoint without completing the assessment legitimately, compromising the integrity of assessments.
AnalysisAI
Koollab LMS 5.3.2 exposes correct quiz answers through the course status endpoint to authenticated learners without requiring legitimate assessment completion. An attacker with a valid student account can retrieve answers and compromise exam integrity.
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | An attacker must hold a valid learner account on the Koollab LMS instance. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | CVSS 3.1 score of 4.3 (Medium) reflects network attack vector, low complexity, low privileges required (learner account), and low confidentiality impact with no integrity or availability loss. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A student logs into Koollab LMS and sends a direct API request to the course status endpoint for an upcoming quiz. The response includes the correct answers, enabling the student to cheat on the assessment. |
| Remediation | No specific patched version is noted in the provided data; consult the CSA advisory AL-2026-094 for vendor‑released remediation. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Koollab Lms
View allArbitrary file upload and remote code execution in Koollab LMS allows an authenticated module designer to achieve full s
Remote code execution in Koollab LMS 5.3.2 lets an authenticated attacker chain SQL injection (CWE-89) and PHP object in
Remote code execution in Koollab LMS allows authenticated attackers to chain SQL injection with unsafe deserialization,
Remote code execution in Koollab LMS allows authenticated attackers to exploit SQL injection and unsafe deserialization
Error-based SQL injection in Koollab LMS allows unauthenticated attackers to exfiltrate sensitive database contents, inc
Blind SQL injection in Koollab LMS enables unauthenticated attackers to exfiltrate sensitive database contents, includin
Error-based SQL injection in Koollab LMS 5.3.2 lets an authenticated attacker abuse the face-to-face runs update endpoin
An authentication bypass in Koollab LMS allows unauthenticated attackers to take over any account, including administrat
Exposure of hard-coded AWS IAM credentials in Koollab LMS 5.3.2 allows authenticated attackers with low privileges to ac
Two-factor authentication bypass in Koollab LMS allows attackers to supply a client-controlled TOTP seed and generate a
Integrity compromise in Koollab LMS allows authenticated learners to falsify lesson completion records via the SCORM com
Forced session termination via the login kickout endpoint in Koollab LMS allows unauthenticated attackers to deny servic
Same weakness CWE-200 – Information Exposure
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today