EUVD-2026-82338Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Network API reachable at low complexity but needs a valid personal token (PR:L); leak of private discussions is confidentiality-only, so I:N/A:N, matching the vendor 6.5.
Primary rating from Vendor (github).
CVSS VectorVendor: github
Lifecycle Timeline
2DescriptionCVE.org
Scoold is a Q&A and a knowledge sharing platform for teams. Prior to 1.69.0, users with personal API tokens can retrieve replies from questions in private spaces they cannot access because src/main/java/com/erudika/scoold/api/ApiController.java in ApiController.getPostReplies() does not apply canAccessSpace before returning data from GET /api/posts/{id}/answers. The issue is reachable when scoold.api_user_access_enabled and scoold.api_enabled are true and a token holder knows or enumerates a private question identifier. Under those conditions, the question endpoint can deny access while the answers endpoint returns the private reply bodies, exposing confidential team or project discussions. This issue is fixed in version 1.69.0.
AnalysisAI
Scoold deployments prior to 1.69.0 expose replies to questions in private spaces through the answers API: a holder of a valid personal API token can call GET /api/posts/{id}/answers and receive the reply bodies of a private-space question whose own endpoint correctly denies access. The flaw affects instances configured with both scoold.api_enabled and scoold.api_user_access_enabled set to true, and exploitation additionally requires the attacker to know or enumerate the target question's identifier, so it is a confidentiality-only (C:H, no I/A) disclosure of existing private discussion content rated 6.5. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the Scoold instance has both scoold.api_user_access_enabled and scoold.api_enabled set to true (the user-facing API mode), and the attacker must hold a valid personal API token and know or enumerate the identifier of a specific private-space question. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine but moderate-severity confidentiality issue, not an over-scored one. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade Scoold to 1.69.0, the version in which the missing canAccessSpace() check is added to the replies endpoint and to adjacent comment and reply handlers; the vendor-released patch is the definitive fix and the remediation target for all pre-1.69.0 deployments (release: https://github.com/Erudika/scoold/releases/tag/1.69.0, advisory: https://github.com/Erudika/scoold/security/advisories/GHSA-2cff-ppf7-pc42). … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Oracle Java SE 7 Update 6 and earlier contains multiple sandbox bypass vulnerabilities via the ClassFinder and forName m
Remote code execution in IBM Sterling B2B Integrator, Sterling Integrator, and Tivoli Common Reporting allows unauthenti
Java Runtime Environment sandbox bypass via incorrect image channel verification in 2D component allows remote unauthent
Oracle Java SE JDK/JRE 7 and 6 Update 27 and earlier allows remote code execution with complete system compromise throug
JBoss Seam 2 in Red Hat JBoss EAP 4.3.0 fails to sanitize JBoss Expression Language inputs, allowing remote attackers to
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 update 4 and earlier, 6 up
Multiple vulnerabilities in Oracle Java 7 before Update 11 allow remote attackers to execute arbitrary code by (1) using
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 2 and earlier, 6 Up
The WLS Security component in Oracle WebLogic Server 10.3.6.0, 12.1.2.0, 12.1.3.0, and 12.2.1.0 allows remote attackers
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier allow
Remote unauthenticated attackers can execute arbitrary code on Adobe ColdFusion servers through Java deserialization fla
The ExceptionDelegator component in Apache Struts before 2.2.3.1 interprets parameter values as OGNL expressions during
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today