EUVD-2026-50137
GHSA-qqq4-m483-fm7p
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as learner
-
ExploitSend crafted request to SCORM commit endpoint
-
ExecutionBypass material viewing requirement
-
ImpactFalsify lesson completion record
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Object-level authorization, IDOR prevention
|
| Exploitation Conditions | Requires an authenticated learner account with access to the SCORM commit endpoint. No special configuration needed beyond default setup. Limiting factor: attacker must have valid learner credentials, restricting exploitation to insiders or compromised accounts. The vulnerability does not require user interaction. |
| Impact | The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) yields a base score of 4.3 (Medium). Attack vector is network, complexity low, but requires authenticated learner privileges (PR:L) - not unauthenticated exploitation. Integrity impact is low (I:L), as only training records are affected, not system files or data. No EPSS score or KEV status is available, and no public POC has been identified. The risk is limited to insider threats or compromised learner accounts; it is unlikely to be a priority for general patching but may be significant for compliance-sensitive environments. |
| Exploit ScenarioDerived | An authenticated learner sends a crafted HTTP request to the SCORM commit endpoint with a completion status parameter, bypassing client-side tracking. The server accepts the request and marks the lesson complete, falsely recording training progress. No public POC exists but the attack is straightforward given knowledge of the endpoint. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 29, 2026
Integrity compromise in Koollab LMS allows authenticated learners to falsify lesson completion records via the SCORM commit endpoint without viewing material. Affects version 5.3.2, compromising training and compliance records. No public exploit or active exploitation identified at time of analysis.
RemediationAI
No vendor-released patch has been identified at time of analysis. Implement server-side validation to track lesson viewing time or require client-side events confirming material interaction before accepting SCORM commit calls. Alternatively, disable the SCORM commit endpoint for non-admin users if feasible, but note this may break legitimate SCORM functionality. Audit logs for unusual completion patterns and enforce mandatory lesson duration minimums as a compensating control.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is a business logic flaw in the SCORM (Sharable Content Object Reference Model) commit endpoint, which fails to verify that a learner actually interacted with lesson material before accepting completion status changes. The affected product is three_learning:koollab_lms (CPE cpe:2.3:a:three_learning:koollab_lms:*:*:*:*:*:*:*:*), specifically version 5.3.2. While no CWE is assigned, the root cause class aligns with CWE-840 (Business Logic Errors), where the server trusts client-provided completion data without independent validation.
Know when Koollab Lms gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Requires authenticated access (PR:L), network exploit, low integrity impact only.
Primary rating from Vendor (CSA).
CVSS VectorVendor: CSA
DescriptionCVE.org
A business logic vulnerability in Koollab LMS allowed an authenticated learner to set their lesson completion status to completed via the SCORM commit endpoint without viewing the lesson material, compromising training and completion records.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Koollab Lms
View allArbitrary file upload and remote code execution in Koollab LMS allows an authenticated module designer to achieve full s
Remote code execution in Koollab LMS 5.3.2 lets an authenticated attacker chain SQL injection (CWE-89) and PHP object in
Remote code execution in Koollab LMS allows authenticated attackers to chain SQL injection with unsafe deserialization,
Remote code execution in Koollab LMS allows authenticated attackers to exploit SQL injection and unsafe deserialization
Error-based SQL injection in Koollab LMS allows unauthenticated attackers to exfiltrate sensitive database contents, inc
Blind SQL injection in Koollab LMS enables unauthenticated attackers to exfiltrate sensitive database contents, includin
Error-based SQL injection in Koollab LMS 5.3.2 lets an authenticated attacker abuse the face-to-face runs update endpoin
An authentication bypass in Koollab LMS allows unauthenticated attackers to take over any account, including administrat
Exposure of hard-coded AWS IAM credentials in Koollab LMS 5.3.2 allows authenticated attackers with low privileges to ac
Two-factor authentication bypass in Koollab LMS allows attackers to supply a client-controlled TOTP seed and generate a
Koollab LMS 5.3.2 exposes correct quiz answers through the course status endpoint to authenticated learners without requ
Forced session termination via the login kickout endpoint in Koollab LMS allows unauthenticated attackers to deny servic
Exploit-DB