CVE-2026-56877mediumCWE-472

CVE-2026-56877: falha de média gravidade em Skillable SCORM Lab Launch Integration

Publicada em 13 jul 2026 · Atualizada em 16 jul 2026

Seguir esta CVE + Monitorar SCORM Lab Launch Integration

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 6.3epss 0.4%

The SCORM lab launch endpoint in Skillable (scorm.skillable.com) through 2026-07-13 does not validate the client-supplied userId parameter against the authenticated SCORM session token. An authenticated user can substitute arbitrary userId values to bypass per-user lab launch rate limits and consume other users' lab allocations, resulting in denial of service against targeted users' lab and exam access. Skillable was formerly named Learn on Demand Systems.

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Produtos afetados

Skillable · SCORM Lab Launch Integration

Referências

http://seclists.org/fulldisclosure/2026/Jul/20 https://www.openwall.com/lists/oss-security/2026/07/12/1 https://www.skillable.com/security/http://www.openwall.com/lists/oss-security/2026/07/12/1 http://www.openwall.com/lists/oss-security/2026/07/12/2