CVE-2026-41243

OpenLearn is open-source educational forum software. Prior to commit 844b2a40a69d0c4911580fe501923f0b391313ab, when `safeMode` is enabled, unapproved forum posts are hidden from the public list, but the direct post-read procedure still returns the full post to anyone with the post UUID. Commit 844b2a40a69d0c4911580fe501923f0b391313ab fixes the issue.

CVSS v3 5.4 MEDIUM

5.4^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 2.5

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/siemvk/OpenLearn/commit/844b2a40a69d0c4911580fe501923f0b391313ab	Patch
https://github.com/siemvk/OpenLearn/security/advisories/GHSA-4rv3-hfh6-vqvm	Exploit Vendor Advisory
https://github.com/siemvk/OpenLearn/security/advisories/GHSA-4rv3-hfh6-vqvm	Exploit Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:siemvk:openlearn:*:*:*:*:*:*:*:*

History

26 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) OpenLearn es un software de foro educativo de código abierto. Antes del commit 844b2a40a69d0c4911580fe501923f0b391313ab, cuando ’safeMode’ está habilitado, las publicaciones de foro no aprobadas están ocultas de la lista pública, pero el procedimiento de lectura directa de la publicación aún devuelve la publicación completa a cualquiera que tenga el UUID de la publicación. El commit 844b2a40a69d0c4911580fe501923f0b391313ab corrige el problema.

Information

Published : 2026-04-23 02:16

Updated : 2026-10-26 21:10

NVD link : CVE-2026-41243

Mitre link : CVE-2026-41243

CVE.ORG link : CVE-2026-41243

JSON object : View

Products Affected

siemvk

openlearn

CWE

CWE-284

Improper Access Control

{"id": "CVE-2026-41243", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-41243", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-23T13:54:48.062482Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 2.5, "exploitabilityScore": 2.8}], "cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 6.9, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "siemvk", "product": "OpenLearn", "versions": [{"status": "affected", "version": "< 844b2a40a69d0c4911580fe501923f0b391313ab"}]}]}], "published": "2026-04-23T02:16:19.040", "references": [{"url": "https://github.com/siemvk/OpenLearn/commit/844b2a40a69d0c4911580fe501923f0b391313ab", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/siemvk/OpenLearn/security/advisories/GHSA-4rv3-hfh6-vqvm", "tags": ["Exploit", "Vendor Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/siemvk/OpenLearn/security/advisories/GHSA-4rv3-hfh6-vqvm", "tags": ["Exploit", "Vendor Advisory"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-284"}]}], "descriptions": [{"lang": "en", "value": "OpenLearn is open-source educational forum software. Prior to commit 844b2a40a69d0c4911580fe501923f0b391313ab, when `safeMode` is enabled, unapproved forum posts are hidden from the public list, but the direct post-read procedure still returns the full post to anyone with the post UUID. Commit 844b2a40a69d0c4911580fe501923f0b391313ab fixes the issue."}, {"lang": "es", "value": "OpenLearn es un software de foro educativo de c\u00f3digo abierto. Antes del commit 844b2a40a69d0c4911580fe501923f0b391313ab, cuando \u2019safeMode\u2019 est\u00e1 habilitado, las publicaciones de foro no aprobadas est\u00e1n ocultas de la lista p\u00fablica, pero el procedimiento de lectura directa de la publicaci\u00f3n a\u00fan devuelve la publicaci\u00f3n completa a cualquiera que tenga el UUID de la publicaci\u00f3n. El commit 844b2a40a69d0c4911580fe501923f0b391313ab corrige el problema."}], "lastModified": "2026-10-26T21:10:00.170", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:siemvk:openlearn:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "BA2E9E54-0BCB-47E7-B3DF-8AC60B2479DB", "versionEndExcluding": "2026-04-14"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}