Scoold EUVD-2026-28818

The attacker must be a high-privilege account holder (PR:H in CVSS vector), meaning they must already possess valid authentication credentials such as an admin API token or a previously-compromised high-privilege user account. The vulnerability requires network access to the /api/config/set/admins endpoint, which is typically exposed on the same network as authenticated API clients. The application must be restarted (either by operator action or through a deployment cycle) for the injected admin email to take effect; exploitation does not grant immediate admin access in the current running process. The configuration API must accept Bearer token authentication without proper validation of token authenticity or signature. Non-default configurations that restrict /api/config/set/admins access or disable the configuration API would prevent exploitation.

CVSS 6.7 (Medium-High) reflects high integrity and confidentiality impact balanced against the requirement for high privileges (PR:H), indicating the vulnerability requires an already-privileged attacker. However, the exploitation conditions are concerning: network accessibility (AV:N), low complexity (AC:L), and no user interaction (UI:N) mean any high-privilege account can execute this attack reliably. The delayed nature of privilege escalation (requiring restart) reduces immediate operational impact but increases persistence risk. EPSS data is unavailable for independent comparison, but the CVSS vector's PR:H requirement suggests this is primarily a privilege escalation and persistence risk rather than an open unauthenticated remote code execution. The real-world risk depends heavily on whether high-privilege API tokens are commonly exposed, leaked, or brute-forceable in target deployments. The vulnerability is confirmed patched in 1.67.0, reducing urgency only for patched instances.

An attacker with access to a leaked or brute-forced Scoold API token (or extracted from a compromised integration) crafts a POST request to /api/config/set/admins with a forged Bearer token containing an email address under their control. The endpoint accepts the malicious token and writes the attacker's email to the Scoold configuration file. Upon the next scheduled restart or when the system administrator restarts Scoold for maintenance, the application loads the modified configuration and registers the attacker's email as an administrator, granting full admin panel access and persistence.