CVE-2026-56877mediumCWE-472

CVE-2026-56877: medium-severity vulnerability in Skillable SCORM Lab Launch Integration

Published 13 Jul 2026 · Updated 16 Jul 2026

Follow this CVE + Monitor SCORM Lab Launch Integration

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 6.3epss 0.4%

The SCORM lab launch endpoint in Skillable (scorm.skillable.com) through 2026-07-13 does not validate the client-supplied userId parameter against the authenticated SCORM session token. An authenticated user can substitute arbitrary userId values to bypass per-user lab launch rate limits and consume other users' lab allocations, resulting in denial of service against targeted users' lab and exam access. Skillable was formerly named Learn on Demand Systems.

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Affected products

Skillable · SCORM Lab Launch Integration

References

http://seclists.org/fulldisclosure/2026/Jul/20 https://www.openwall.com/lists/oss-security/2026/07/12/1 https://www.skillable.com/security/http://www.openwall.com/lists/oss-security/2026/07/12/1 http://www.openwall.com/lists/oss-security/2026/07/12/2