Scoold EUVD-2026-102311

Exploitation requires three concrete conditions: (1) the victim must have an active authenticated Scoold session in the same browser; (2) the victim must visit or be redirected to an attacker-controlled web page (the UI:R / user-interaction requirement); and (3) the vulnerable CORS filter must be active - affected versions prior to 1.69.1 hardcode addAllowedOriginPattern("*") with setAllowCredentials(true), so no non-default tuning is needed on the server side for the reflection to occur. Limiting factors that reduce real-world risk: the attack abuses one victim's session at a time rather than compromising the server directly, it fails if the user is logged out or uses a separate browser, and the 1.69.1 fix (cors_allowed_origins allowlist defaulting to same-origin) eliminates the reflection entirely.

This is a moderate, not top-priority, issue whose signals are internally consistent rather than conflicting. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N, base 5.4) correctly captures a CWE-346 origin-validation flaw: the attacker needs no Scoold privileges (PR:N) but does require a logged-in victim to visit a malicious page (UI:R), and impact is partial on confidentiality and integrity with no availability effect. No EPSS score, KEV listing, POC, or SSVC decision data was provided in the input, so exploitation-likelihood and automatability cannot be quantified from the sources given - this must be treated as a gap, not as evidence of low risk. The practical ceiling on severity is the UI:R requirement plus the fact that only a single victim's session is abused per attack (no mass/automatable exploitation of the server itself), which keeps this well below the 'drop everything' tier despite being remotely reachable and affecting default configurations. The root cause is firmly confirmed by the vendor commit (addAllowedOriginPattern("*") combined with setAllowCredentials(true)), so the technical validity of the finding is not in doubt - only its real-world exploitation frequency is unknown.

An authenticated Scoold user is lured to a malicious web page while their session is active. Attacker-controlled JavaScript on that page issues credentialed cross-origin requests to the victim's Scoold instance; because the server reflects any origin and allows credentials, the browser returns responses, letting the attacker read the user's data, questions, and configuration and trigger state-changing actions as that user. No public exploit identified at time of analysis, and the attack requires the victim's interaction (visiting the page) per the CVSS UI:R metric.