Skip to content
CVE PROGRAM SOURCE RECORD3.7 Low

CVE-2026-63236

Improper access control vulnerability

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
CSA

Description

An improper access control vulnerability in Koollab LMS allowed an unauthenticated attacker to read another user's name, internal identifier, scores, lesson status, lesson position, and cached lesson state via the SCORM API endpoint.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Three Learning Koollab LMS

Default version status: unaffected

  • 5.3.2affected

References