Read the docs
TI-2026-30501 Aliases CVE-2026-42176

Missing authentication in Erudika scoold

Priority HIGH 65CWE-306Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · Low
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-306.

Summary

Scoold is a Q&A and a knowledge sharing platform for teams. Prior to version 1.67.0, Scoold allows the admins configuration value to be modified through /api/config/set/admins with a forged Bearer token that is accepted as an admin API token. Once that setting is changed, the target email address is written to the application configuration file. The change does not become active immediately in the current process, because the ADMINS set is loaded once at startup. After a Scoold restart, though, the selected user is recognized as an administrator and gains access to the admin panel. This issue gives an attacker a reliable persistence path: write their own email into scoold.admins, wait for a restart or trigger one operationally, and the account comes back as admin. This issue has been patched in version 1.67.0.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00312 24th percentileScored 2026-11-07
Fix Fixed scoold (Erudika): 1.67.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Erudikascooldbefore 1.67.01.67.0Patch availableCNA
  • scoold VendorErudika Affected before 1.67.0 Fixed in 1.67.0 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:erudika:scoold:*:*:*:*:*:*:*:*——Erudika
  • cpe:2.3:a:erudika:scoold:*:*:*:*:*:*:*:* Versions — — ·Erudika

Remediation

  • Fix · CNA scoold (Erudika) Fixed in 1.67.0

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-42176

References

Other 2

  • TI-2026-74990 Scoold accepts forged JWTs as admin, exposing config and logs CVSS 3.1MEDIUM 6.1
  • TI-2026-28342 Scoold has an Authenticated Arbitrary Question Overwrite via Client-Controlled postId in POST /questions/ask CVSS 3.1MEDIUM 6.5
  • TI-2026-27076 Scoold: Cross-Account Feedback Deletion (IDOR) CVSS 3.1MEDIUM 6.5
  • TI-2026-74986 Open redirect in Scoold sign-in lets attackers redirect users CVSS 3.1MEDIUM 5.4
  • TI-2024-33769 Semicolon Path Injection on API /api;/config CVSS 4.0HIGH 8.7
  • TI-2022-01415 Improper handling of Length parameter in erudika/scoold CVSS 3.1HIGH 8.8
See all 14 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences