CVE-2026-39354

Scoold is a Q&A and a knowledge sharing platform for teams. Prior to 1.66.2, an authenticated authorization flaw in Scoold allows any logged-in, low-privilege user to overwrite another user's existing question by supplying that question's public ID as the postId parameter to POST /questions/ask. Because question IDs are exposed in normal question URLs, a low-privilege attacker can take a victim question ID from a public page and cause attacker-controlled content to be stored under that existing question object. This causes direct integrity loss of user-generated content and corrupts the integrity of the existing discussion thread. This vulnerability is fixed in 1.66.2.

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/Erudika/scoold/security/advisories/GHSA-768r-cv9p-wrcm	Exploit Vendor Advisory
https://github.com/Erudika/scoold/security/advisories/GHSA-768r-cv9p-wrcm	Exploit Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:erudika:scoold:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2026-04-07 19:16

Updated : 2026-07-24 21:10

NVD link : CVE-2026-39354

Mitre link : CVE-2026-39354

CVE.ORG link : CVE-2026-39354

JSON object : View

Products Affected

erudika

scoold

CWE

CWE-639

Authorization Bypass Through User-Controlled Key

{"id": "CVE-2026-39354", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-39354", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-09T15:04:47.366387Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "Erudika", "product": "scoold", "versions": [{"status": "affected", "version": "< 1.66.2"}]}]}], "published": "2026-04-07T19:16:46.357", "references": [{"url": "https://github.com/Erudika/scoold/security/advisories/GHSA-768r-cv9p-wrcm", "tags": ["Exploit", "Vendor Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/Erudika/scoold/security/advisories/GHSA-768r-cv9p-wrcm", "tags": ["Exploit", "Vendor Advisory"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-639"}]}], "descriptions": [{"lang": "en", "value": "Scoold is a Q&A and a knowledge sharing platform for teams. Prior to 1.66.2, an authenticated authorization flaw in Scoold allows any logged-in, low-privilege user to overwrite another user's existing question by supplying that question's public ID as the postId parameter to POST /questions/ask. Because question IDs are exposed in normal question URLs, a low-privilege attacker can take a victim question ID from a public page and cause attacker-controlled content to be stored under that existing question object. This causes direct integrity loss of user-generated content and corrupts the integrity of the existing discussion thread. This vulnerability is fixed in 1.66.2."}, {"lang": "es", "value": "Scoold es una plataforma de preguntas y respuestas y de intercambio de conocimientos para equipos. Antes de la versi\u00f3n 1.66.2, un fallo de autorizaci\u00f3n autenticado en Scoold permite a cualquier usuario con sesi\u00f3n iniciada y de bajo privilegio sobrescribir la pregunta existente de otro usuario proporcionando el ID p\u00fablico de esa pregunta como el par\u00e1metro postId a POST /questions/ask. Debido a que los ID de las preguntas est\u00e1n expuestos en las URL normales de las preguntas, un atacante de bajo privilegio puede tomar el ID de una pregunta de la v\u00edctima de una p\u00e1gina p\u00fablica y hacer que el contenido controlado por el atacante se almacene bajo ese objeto de pregunta existente. Esto causa una p\u00e9rdida directa de integridad del contenido generado por el usuario y corrompe la integridad del hilo de discusi\u00f3n existente. Esta vulnerabilidad est\u00e1 corregida en la versi\u00f3n 1.66.2."}], "lastModified": "2026-07-24T21:10:00.143", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:erudika:scoold:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8F1340F2-5D49-4F87-B3DB-2187E5842588", "versionEndExcluding": "1.66.2"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}