LearnHouse EUVD-2026-97887

Exploitation requires (1) an authenticated account possessing playground creation rights, such as the Instructor role (PR:L - not anonymous), and (2) prior knowledge of the exact UUID of a RESTRICTED or unpublished/draft playground owned by someone else (AT:P). The specific trigger is the POST /api/v1/playgrounds/{uuid}/duplicate endpoint, which fails to re-run the read-access and draft checks that get_playground applies. Limiting factors: only LearnHouse versions before 1.4.0 are affected; the attacker cannot act anonymously and must obtain a valid random UUID (not trivially guessable), which materially constrains opportunistic attacks; impact is limited to disclosure/republication of the playground's html_content.

This is a genuinely low-priority issue, and the signals are consistent rather than conflicting. The vendor-supplied CVSS 4.0 base score is 2.3 (Low), driven by authenticated access (PR:L), a present attack requirement (AT:P - the attacker must know a specific RESTRICTED/unpublished playground UUID), and only low confidentiality impact (VC:L) with no integrity or availability impact (VI:N/VA:N). No EPSS score, CISA KEV listing, or public POC was provided in the intelligence set, so there is no evidence of widespread or automatable exploitation. The practical risk is an insider/privilege-abuse disclosure: an already-trusted instructor-level user viewing content they were not authorized to see, not remote mass exploitation. Treat as a routine hardening fix (patch is available) rather than an emergency. Note one cross-source nuance worth stating explicitly: the input Tag labels this 'Authentication Bypass', but the CWE (CWE-862 Missing Authorization) and the description describe an AUTHORIZATION flaw - the user remains fully authenticated; only the resource-level read/draft check is skipped.

An instructor (or other role with playground creation rights) obtains the UUID of a colleague's RESTRICTED or unpublished playground - for example from a shared link, logs, or sequential discovery - and calls POST /api/v1/playgrounds/{uuid}/duplicate. Because the endpoint skips the read-access and draft checks that get_playground enforces, the server copies the private html_content into a new playground the attacker owns, which they then republish publicly. No public exploit code was identified at time of analysis.