Scoold
Monthly
Authentication bypass in Scoold (Erudika) prior to 1.69.1 allows an attacker who already possesses one of the server signing secrets - app_secret_key or para_secret_key - to forge a JWT that is accepted for the /api/config and /api/stats endpoints and mapped to the hardcoded administrative API_USER, thereby reading sensitive configuration and server logs and reaching privileged configuration functionality. An ordinary user login-session token is explicitly insufficient for this attack, and the vulnerable check runs even when scoold.api_enabled is false, so turning off the API is not a mitigation. No public exploit code and no confirmed active exploitation were identified at time of analysis; because the attack hinges entirely on obtaining a server-side signing secret, the input CVSS of 6.1 (assessed vector AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N) reflects a medium-severity, heavily preconditioned issue rather than an open, remotely reachable bypass.
Open redirect in Scoold, Erudika's Java-based Q&A and knowledge-sharing platform, affects every release prior to 1.69.1, where the backto and returnto parameters handled by HttpUtils.getBackToUrl() are validated with a case-insensitive prefix match against the configured server URL. An unauthenticated attacker can craft a sign-in link whose backto value is an absolute URL on a look-alike host such as example.com.evil.com; URI.resolve() retains the attacker URL, the prefix check passes, and the victim is redirected to the attacker's domain after completing authentication. The result is phishing and possible credential or token theft on the malicious site, but exploitation hinges on the victim following the crafted link and signing in (UI:R); no public exploit code and no confirmed active exploitation have been identified at time of analysis.
Cross-origin request forgery in Erudika Scoold prior to 1.69.1 lets any attacker-controlled website issue credentialed API calls against an authenticated user's session, exposing user data, questions, and server configuration, and allowing state-changing actions on the victim's behalf. The CORS filter combines a wildcard origin pattern with credential support, so any requesting origin is reflected back with Access-Control-Allow-Credentials, meaning the only barriers are that the victim must have a live Scoold session in the same browser and must be lured to the attacker's page (CVSS 3.1 5.4, AV:N/AC:L/PR:N/UI:R, CWE-346). No public exploit code has been identified and the issue is not in CISA KEV; the vendor-released patch is version 1.69.1, which replaces the wildcard with a same-origin default or an explicit allowlist via the new cors_allowed_origins setting.
Authentication bypass in Scoold prior to version 1.67.0 allows high-privileged attackers to inject arbitrary administrator email addresses via the /api/config/set/admins endpoint using a forged Bearer token, establishing persistent administrative access after application restart. The vulnerability exploits insufficient token validation in the configuration API, enabling attackers to escalate privileges reliably by injecting their own email into the admin configuration file, which is loaded on startup.
Scoold versions prior to 1.66.2 allow authenticated low-privilege users to overwrite arbitrary existing questions by submitting a POST request to /questions/ask with another user's question ID as the postId parameter. Since question IDs are publicly visible in URLs, attackers can identify target questions and replace their content with malicious text, corrupting discussion threads and destroying legitimate user-generated content. The vulnerability requires only basic user authentication and network access, making it trivially exploitable by any logged-in account.
Scoold versions prior to 1.66.1 allow authenticated low-privilege users to delete any other user's feedback posts via an authorization flaw in the POST /feedback/{id}/delete endpoint. The vulnerability requires login but lacks object ownership verification, enabling lateral privilege escalation where any team member can destroy feedback created by colleagues or administrators. No public exploit code or active exploitation has been identified; the issue was discovered during code review and patched in version 1.66.1.
Scoold is a Q&A and a knowledge sharing platform for teams. Rated high severity (CVSS 8.7), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Improper handling of Length parameter in GitHub repository erudika/scoold prior to 1.49.4. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Authentication bypass in Scoold (Erudika) prior to 1.69.1 allows an attacker who already possesses one of the server signing secrets - app_secret_key or para_secret_key - to forge a JWT that is accepted for the /api/config and /api/stats endpoints and mapped to the hardcoded administrative API_USER, thereby reading sensitive configuration and server logs and reaching privileged configuration functionality. An ordinary user login-session token is explicitly insufficient for this attack, and the vulnerable check runs even when scoold.api_enabled is false, so turning off the API is not a mitigation. No public exploit code and no confirmed active exploitation were identified at time of analysis; because the attack hinges entirely on obtaining a server-side signing secret, the input CVSS of 6.1 (assessed vector AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N) reflects a medium-severity, heavily preconditioned issue rather than an open, remotely reachable bypass.
Open redirect in Scoold, Erudika's Java-based Q&A and knowledge-sharing platform, affects every release prior to 1.69.1, where the backto and returnto parameters handled by HttpUtils.getBackToUrl() are validated with a case-insensitive prefix match against the configured server URL. An unauthenticated attacker can craft a sign-in link whose backto value is an absolute URL on a look-alike host such as example.com.evil.com; URI.resolve() retains the attacker URL, the prefix check passes, and the victim is redirected to the attacker's domain after completing authentication. The result is phishing and possible credential or token theft on the malicious site, but exploitation hinges on the victim following the crafted link and signing in (UI:R); no public exploit code and no confirmed active exploitation have been identified at time of analysis.
Cross-origin request forgery in Erudika Scoold prior to 1.69.1 lets any attacker-controlled website issue credentialed API calls against an authenticated user's session, exposing user data, questions, and server configuration, and allowing state-changing actions on the victim's behalf. The CORS filter combines a wildcard origin pattern with credential support, so any requesting origin is reflected back with Access-Control-Allow-Credentials, meaning the only barriers are that the victim must have a live Scoold session in the same browser and must be lured to the attacker's page (CVSS 3.1 5.4, AV:N/AC:L/PR:N/UI:R, CWE-346). No public exploit code has been identified and the issue is not in CISA KEV; the vendor-released patch is version 1.69.1, which replaces the wildcard with a same-origin default or an explicit allowlist via the new cors_allowed_origins setting.
Authentication bypass in Scoold prior to version 1.67.0 allows high-privileged attackers to inject arbitrary administrator email addresses via the /api/config/set/admins endpoint using a forged Bearer token, establishing persistent administrative access after application restart. The vulnerability exploits insufficient token validation in the configuration API, enabling attackers to escalate privileges reliably by injecting their own email into the admin configuration file, which is loaded on startup.
Scoold versions prior to 1.66.2 allow authenticated low-privilege users to overwrite arbitrary existing questions by submitting a POST request to /questions/ask with another user's question ID as the postId parameter. Since question IDs are publicly visible in URLs, attackers can identify target questions and replace their content with malicious text, corrupting discussion threads and destroying legitimate user-generated content. The vulnerability requires only basic user authentication and network access, making it trivially exploitable by any logged-in account.
Scoold versions prior to 1.66.1 allow authenticated low-privilege users to delete any other user's feedback posts via an authorization flaw in the POST /feedback/{id}/delete endpoint. The vulnerability requires login but lacks object ownership verification, enabling lateral privilege escalation where any team member can destroy feedback created by colleagues or administrators. No public exploit code or active exploitation has been identified; the issue was discovered during code review and patched in version 1.66.1.
Scoold is a Q&A and a knowledge sharing platform for teams. Rated high severity (CVSS 8.7), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Improper handling of Length parameter in GitHub repository erudika/scoold prior to 1.49.4. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.