EUVD-2026-50135
GHSA-9ch9-66pf-cjcf
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as learner
-
ExploitRequest course status endpoint for target quiz
-
ImpactParse response for correct answers
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V14 - Data Protection Data exposure prevention
MITRE ATT&CK
2 techniques across 2 tactics: Collection, Discovery The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | An attacker must hold a valid learner account on the Koollab LMS instance. The course status endpoint must be accessible and return answer data to any authenticated learner without verifying whether the assessment has been completed. No further configuration or user interaction is required. |
| Impact | CVSS 3.1 score of 4.3 (Medium) reflects network attack vector, low complexity, low privileges required (learner account), and low confidentiality impact with no integrity or availability loss. EPSS exploitation probability is unknown; no KEV listing or public exploitation evidence exists. The vulnerability requires authentication, limiting risk to insider threats and assessment integrity rather than direct system compromise. Absent a known exploit, real‑world risk remains moderate. |
| Exploit ScenarioDerived | A student logs into Koollab LMS and sends a direct API request to the course status endpoint for an upcoming quiz. The response includes the correct answers, enabling the student to cheat on the assessment. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 29, 2026
Koollab LMS 5.3.2 exposes correct quiz answers through the course status endpoint to authenticated learners without requiring legitimate assessment completion. An attacker with a valid student account can retrieve answers and compromise exam integrity.
RemediationAI
No specific patched version is noted in the provided data; consult the CSA advisory AL-2026-094 for vendor‑released remediation. As an interim workaround, restrict the course status endpoint so it only returns answer data after a user has legitimately submitted the assessment, or disable the endpoint for learners. Monitor logs for abnormal endpoint usage specific to quiz request patterns.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability resides in the Koollab LMS course status endpoint, which fails to restrict access to quiz answer data based on assessment completion status. This constitutes an information exposure flaw (CWE-200: Exposure of Sensitive Information to an Unauthorized Actor). The affected product, identified by CPE cpe:2.3:a:three_learning:koollab_lms:*:*:*:*:*:*:*:*, is developed by Three Learning and is used for learning management scenarios.
Know when Koollab Lms gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Low-privilege authentication required, network accessible, low complexity, and limited confidentiality impact only.
Primary rating from Vendor (CSA).
CVSS VectorVendor: CSA
DescriptionCVE.org
An information disclosure vulnerability in Koollab LMS allowed an authenticated learner to obtain correct quiz answers from the course status endpoint without completing the assessment legitimately, compromising the integrity of assessments.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
More in Koollab Lms
View allArbitrary file upload and remote code execution in Koollab LMS allows an authenticated module designer to achieve full s
Remote code execution in Koollab LMS 5.3.2 lets an authenticated attacker chain SQL injection (CWE-89) and PHP object in
Remote code execution in Koollab LMS allows authenticated attackers to chain SQL injection with unsafe deserialization,
Remote code execution in Koollab LMS allows authenticated attackers to exploit SQL injection and unsafe deserialization
Error-based SQL injection in Koollab LMS allows unauthenticated attackers to exfiltrate sensitive database contents, inc
Blind SQL injection in Koollab LMS enables unauthenticated attackers to exfiltrate sensitive database contents, includin
Error-based SQL injection in Koollab LMS 5.3.2 lets an authenticated attacker abuse the face-to-face runs update endpoin
An authentication bypass in Koollab LMS allows unauthenticated attackers to take over any account, including administrat
Exposure of hard-coded AWS IAM credentials in Koollab LMS 5.3.2 allows authenticated attackers with low privileges to ac
Two-factor authentication bypass in Koollab LMS allows attackers to supply a client-controlled TOTP seed and generate a
Integrity compromise in Koollab LMS allows authenticated learners to falsify lesson completion records via the SCORM com
Forced session termination via the login kickout endpoint in Koollab LMS allows unauthenticated attackers to deny servic
Exploit-DB