EUVD-2026-50137
GHSA-qqq4-m483-fm7p
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Requires authenticated access (PR:L), network exploit, low integrity impact only.
Primary rating from Vendor (CSA).
CVSS VectorVendor: CSA
Lifecycle Timeline
1DescriptionCVE.org
A business logic vulnerability in Koollab LMS allowed an authenticated learner to set their lesson completion status to completed via the SCORM commit endpoint without viewing the lesson material, compromising training and completion records.
AnalysisAI
Integrity compromise in Koollab LMS allows authenticated learners to falsify lesson completion records via the SCORM commit endpoint without viewing material. Affects version 5.3.2, compromising training and compliance records. No public exploit or active exploitation identified at time of analysis.
Technical ContextAI
The vulnerability is a business logic flaw in the SCORM (Sharable Content Object Reference Model) commit endpoint, which fails to verify that a learner actually interacted with lesson material before accepting completion status changes. The affected product is three_learning:koollab_lms (CPE cpe:2.3:a:three_learning:koollab_lms:*:*:*:*:*:*:*:*), specifically version 5.3.2. While no CWE is assigned, the root cause class aligns with CWE-840 (Business Logic Errors), where the server trusts client-provided completion data without independent validation.
RemediationAI
No vendor-released patch has been identified at time of analysis. Implement server-side validation to track lesson viewing time or require client-side events confirming material interaction before accepting SCORM commit calls. Alternatively, disable the SCORM commit endpoint for non-admin users if feasible, but note this may break legitimate SCORM functionality. Audit logs for unusual completion patterns and enforce mandatory lesson duration minimums as a compensating control.
More in Koollab Lms
View allArbitrary file upload and remote code execution in Koollab LMS allows an authenticated module designer to achieve full s
Remote code execution in Koollab LMS 5.3.2 lets an authenticated attacker chain SQL injection (CWE-89) and PHP object in
Remote code execution in Koollab LMS allows authenticated attackers to chain SQL injection with unsafe deserialization,
Remote code execution in Koollab LMS allows authenticated attackers to exploit SQL injection and unsafe deserialization
Error-based SQL injection in Koollab LMS allows unauthenticated attackers to exfiltrate sensitive database contents, inc
Blind SQL injection in Koollab LMS enables unauthenticated attackers to exfiltrate sensitive database contents, includin
Error-based SQL injection in Koollab LMS 5.3.2 lets an authenticated attacker abuse the face-to-face runs update endpoin
An authentication bypass in Koollab LMS allows unauthenticated attackers to take over any account, including administrat
Exposure of hard-coded AWS IAM credentials in Koollab LMS 5.3.2 allows authenticated attackers with low privileges to ac
Two-factor authentication bypass in Koollab LMS allows attackers to supply a client-controlled TOTP seed and generate a
Koollab LMS 5.3.2 exposes correct quiz answers through the course status endpoint to authenticated learners without requ
Forced session termination via the login kickout endpoint in Koollab LMS allows unauthenticated attackers to deny servic
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today