Scoold EUVD-2026-18529

This vulnerability presents moderate real-world risk despite the CVSS score of 6.5. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N) indicates network-accessible exploitation with low complexity and no user interaction, making it trivially exploitable by any authenticated user. The impact is limited to integrity (unauthorized deletion), not confidentiality or availability, which constrains the blast radius. However, the authentication requirement (PR:L) is significant: attackers must first obtain valid credentials, likely through phishing, credential stuffing, or as an insider threat. In a team collaboration setting, this is a material risk because legitimate employees can be damaged by malicious colleagues deleting their contributions without recovery. SSVC would classify this as exploitable with high technical impact but mitigated by authentication requirements. The lack of any public exploit, KEV status, or known active exploitation suggests this is a defensive discovery rather than an urgent zero-day, making prioritization below critical but above informational.

A disgruntled team member with valid Scoold credentials discovers the endpoint and uses a browser developer console or curl command to POST to /feedback/{id}/delete with a victim's feedback ID obtained from the public feedback listing. The request succeeds without authentication challenge because the user is already logged in, and the server does not check ownership; the victim's feedback disappears immediately from the platform, with no audit trail or recovery option. This scenario requires only network access and valid credentials, not administrator privileges, making it practical for any team member.