CVE-2026-56877mediumCWE-472

CVE-2026-56877: fallo de gravedad media en Skillable SCORM Lab Launch Integration

Publicada el 13 jul 2026 · Actualizada el 16 jul 2026

Seguir esta CVE + Monitorear SCORM Lab Launch Integration

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

13Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 6.3epss 0.4%

The SCORM lab launch endpoint in Skillable (scorm.skillable.com) through 2026-07-13 does not validate the client-supplied userId parameter against the authenticated SCORM session token. An authenticated user can substitute arbitrary userId values to bypass per-user lab launch rate limits and consume other users' lab allocations, resulting in denial of service against targeted users' lab and exam access. Skillable was formerly named Learn on Demand Systems.

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Productos afectados

Skillable · SCORM Lab Launch Integration

Referencias

http://seclists.org/fulldisclosure/2026/Jul/20 https://www.openwall.com/lists/oss-security/2026/07/12/1 https://www.skillable.com/security/http://www.openwall.com/lists/oss-security/2026/07/12/1 http://www.openwall.com/lists/oss-security/2026/07/12/2