Skip to content
CVE PROGRAM SOURCE RECORD6.9 Medium

CVE-2026-41243

OpenLearn's pending forum posts remain publicly readable by direct ID when moderation mode is enabled

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
GitHub_M

Description

OpenLearn is open-source educational forum software. Prior to commit 844b2a40a69d0c4911580fe501923f0b391313ab, when `safeMode` is enabled, unapproved forum posts are hidden from the public list, but the direct post-read procedure still returns the full post to anyone with the post UUID. Commit 844b2a40a69d0c4911580fe501923f0b391313ab fixes the issue.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

siemvk OpenLearn

  • < 844b2a40a69d0c4911580fe501923f0b391313abaffected

References