CVE-2026-109564: low-severity vulnerability in LearnHouse
LearnHouse before 1.4.0 Missing Authorization via Playground Duplicate Endpoint
Published
5Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 2.3
exploitation probability
—
observed exploitation
nono source reports it
LearnHouse before 1.4.0 contains a missing authorization vulnerability in POST /api/v1/playgrounds/{uuid}/duplicate that skips the read-access and draft checks enforced by get_playground. Authenticated users with playground creation rights, such as Instructors, who know a RESTRICTED or unpublished playground UUID can copy its html_content and republish it publicly.
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Affected products
learnhouse · LearnHouseReferences
https://github.com/learnhouse/learnhousehttps://github.com/learnhouse/learnhouse/commit/9a1319185a596ea9b40651dbfd96f05195c0be37https://github.com/learnhouse/learnhouse/pull/1120https://www.vulncheck.com/advisories/learnhouse-before-1.4.0-missing-authorization-via-playground-duplicate-endpoint