LearnHouse EUVD-2026-114720

Requires a valid authenticated LearnHouse account with access to the relevant course (PR:L) - exploitation is not possible unauthenticated. The attacker then supplies another student's user_id to the assignment submission grade endpoint (get_grade_assignment_submission) or to the submission read functions (read_user_assignment_task_submissions / read_assignment_task_submissions / read_user_assignment_submissions), which before 1.1.1 lacked the non-instructor ownership check. Limiting factors: only instances running a version before 1.1.1 are affected; the flaw exposes confidentiality only (other users' submissions, grades, feedback) with no write/integrity or availability impact; and the caller must already be a logged-in user, so it is not remotely anonymous. No special non-default configuration is required - the missing check applies to the default behavior of these endpoints.

This is a genuine but moderate-severity access-control flaw (CWE-639, IDOR-style missing authorization), not an inflated high-CVSS issue. The input CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N) scores 5.3 Medium and aligns well with the description: a network-reachable endpoint, low attack complexity, and - critically - PR:L, meaning a valid authenticated account is required. Impact is confidentiality-only and rated Low (VC:L): an attacker reads other students' submissions, grades, and instructor feedback, with no integrity or availability impact. No EPSS score, CISA KEV listing, or confirmed public exploit code is present in the input, so there is no signal of active or widespread exploitation; the only exploitation evidence is the vendor/VulnCheck advisory and a patch. The vuln.today decision label is 'this_month' (not act_now/emergency), consistent with a medium-confidentiality, authenticated-access flaw. Signals are internally consistent - the CVSS vector, description, and source-code fix all agree that the trigger is an authenticated user supplying another user_id to submission/grade read endpoints that lacked an ownership check. Primary risk is privacy/FERPA-style exposure of student academic records rather than system compromise.

An authenticated student in a LearnHouse course calls the assignment submission or grade read endpoint and substitutes a different user_id (or targets another user's submission record), causing the API to return that victim's submitted work, grade, and instructor feedback. Because the pre-patch code queried the submission by the supplied user_id without verifying it matched the caller, any logged-in user could enumerate peers' academic records. No public exploit code is identified in the input, though a public issue report (#1184) and the fixing commit/PR disclose the exact vulnerable functions.