GibbonEdu Gibbon EUVD-2026-87066

Requires a network-reachable GibbonEdu Gibbon instance at version 30.0.01 or earlier with the Unit Planner (Planner module) present, and the endpoint modules/Planner/units_add_blockAjax.php accessible over HTTP. No authentication, no privileges, and no user interaction are required per the CVSS vector (PR:N/UI:N), so default configurations of affected versions are exploitable by anonymous remote attackers. Limiting factors: the product is deployed primarily by schools rather than at internet scale, many instances may sit behind institutional access controls or VPNs, and impact is confined to low-level confidentiality exposure of unit-planner block data (VI:N/VA:N).

This is a moderate-severity issue that does not rise to urgent-priority status. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N) with base score 6.9 describes a remotely reachable, unauthenticated flaw of low technical impact - only confidentiality is affected at a low level, with no integrity or availability impact and no scope change to subsequent systems. The E:P (Proof-of-Concept) exploit maturity aligns with the description's statement that an exploit has been publicly disclosed, so publicly available exploit code exists - but this is a distinct signal from active exploitation, which is NOT claimed. There is no EPSS score, no CISA KEV listing, and no evidence of in-the-wild use in the provided data. Note a mild tension: the function name 'makeBlock' and CWE-306 (Missing Authentication) suggest an action-oriented endpoint, yet the vendor scored only VC:L with VI:N - implying the practical outcome is unauthorized read access to unit-planner block data rather than data modification; this impact scoping should be verified against the actual patched code, since the shown PR diff is dominated by composer.lock dependency bumps and a separate Calendar access fix rather than the units_add_blockAjax.php change itself. Overall: a real but low-impact bug in a niche education product, appropriate for routine patching rather than emergency response.

An unauthenticated remote attacker sends a crafted HTTP request directly to modules/Planner/units_add_blockAjax.php with manipulated gibbonUnitBlockID/mode parameters, invoking the makeBlock function without any authenticated session. Because the endpoint lacks an authentication/authorization check, the attacker retrieves unit-planner block content they should not have access to. A proof-of-concept has been publicly disclosed, lowering the skill required to reproduce it.