CVE-2026-34832: falha de média gravidade em Erudika scoold
Scoold: Cross-Account Feedback Deletion (IDOR)
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 6.5epss 0.3%
Scoold is a Q&A and a knowledge sharing platform for teams. Prior to version 1.66.1, Scoold contains an authenticated authorization flaw in feedback deletion that allows any logged-in, low-privilege user to delete another user's feedback post by submitting its ID to POST /feedback/{id}/delete. The handler enforces authentication but does not enforce object ownership (or moderator/admin authorization) before deletion. In verification, a second non-privileged account successfully deleted a victim account's feedback item, and the item immediately disappeared from the feedback listing/detail views. This issue has been patched in version 1.66.1.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Produtos afetados
Erudika · scooldCVEs relacionadas — Erudika scoold
No mesmo produto, das mais perigosas para as menos.
CVE-2024-50334HIGHSemicolon Path Injection on API /api;/configEPSS 1.0%CVE-2026-54676MEDIUMScoold: GET /api/posts/{id}/answers leaks private-space replies when personal API tokens are enabledEPSS 0.4%CVE-2026-54677MEDIUMScoold: Authenticated user can post replies and comments to private-space questions without space membershipEPSS 0.4%CVE-2026-42176MEDIUMScoold: Persistent Admin Takeover by Overwriting the admins Configuration Setting via Forged JWT (missing `jti` validation)EPSS 0.3%CVE-2026-57183MEDIUMScoold: Forged JWT Accepted as Admin API Token Allowing Unauthorized Access to Sensitive Configuration and LogsEPSS 0.3%CVE-2026-55840MEDIUMScoold: Open Redirect in getBackToUrl() allows phishing via domain-prefix startsWith bypassEPSS 0.3%