CVEvulnerability

CVE-2026-63242

4.3 MEDIUM Published 2026-07-29 Modified 2026-10-23 Official page ↗
Status
Deferred
Published
2026-07-29
Last modified
2026-10-23
Assigner
5f57b9bf-260d-4433-bf07-b6a79e9bb7d4
CVSS 3.1 (5f57b9bf-260d-4433-bf07-b6a79e9bb7d4)
4.3 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Weaknesses
CWE-639

Description

A business logic vulnerability in Koollab LMS allowed an authenticated learner to set their lesson completion status to completed via the SCORM commit endpoint without viewing the lesson material, compromising training and completion records.

Related

Weakness · CWE (1)

  • CWE-639 Authorization Bypass Through User-Controlled Key weakness

References