Read the docs
TI-2026-20085 Aliases CVE-2026-24900

MarkUs has a submission-view IDOR exposes all student submissions

Priority LOW 29CWE-639Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-639.

Summary

MarkUs is a web application for the submission and grading of student assignments. Prior to 2.9.1, the courses/<:course_id>/assignments/<:assignment_id>/submissions/html_content accepted a select_file_id parameter to serve SubmissionFile objects containing a record of files submitted by students. This parameter was not correctly scoped to the requesting user, allowing users access arbitrary submission file contents by id. This vulnerability is fixed in 2.9.1.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00298 22nd percentileScored 2026-11-07
Fix Fixed Markus (MarkUsProject): 2.9.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
MarkUsProjectMarkusbefore 2.9.12.9.1Patch availableCNA
  • Markus VendorMarkUsProject Affected before 2.9.1 Fixed in 2.9.1 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:markusproject:markus:*:*:*:*:*:*:*:*before 2.9.1VulnerableMarkUsProject
  • cpe:2.3:a:markusproject:markus:*:*:*:*:*:*:*:* Versions before 2.9.1 Vulnerable ·MarkUsProject

Remediation

  • Fix · CNA Markus (MarkUsProject) Fixed in 2.9.1

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-24900

References

Patch 1

Advisory 1

Other 1

  • TI-2026-20241 Zip Slip in MarkUs config upload allowing RCE CVSS 3.1CRITICAL 9.1
  • TI-2026-22679 MarkUs: Stored XSS in Submission HTML Preview Enables Instructor-Context Actions CVSS 3.1HIGH 8.0
  • TI-2024-34648 Arbitrary File Write leading up to remote code execution (instructor accounts) CVSS 4.0HIGH 7.1
  • TI-2024-34420 MarkUs Arbitrary File Write leading up to remote code execution (student accounts) CVSS 4.0HIGH 7.1
  • TI-2026-20987 MarkUs: Zip bomb in config upload enables DoS CVSS 3.1MEDIUM 6.5
  • TI-2024-32087 MarkUs vulnerable to Path Traversal CVSS 3.1MEDIUM 5.7
See all 7 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences