Read the docs
TI-2026-39499 Aliases CVE-2026-54676

Scoold: GET /api/posts/{id}/answers leaks private-space replies when personal API tokens are enabled

Priority LOW 29CWE-862Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-862.

Summary

Scoold is a Q&A and a knowledge sharing platform for teams. Prior to 1.69.0, users with personal API tokens can retrieve replies from questions in private spaces they cannot access because src/main/java/com/erudika/scoold/api/ApiController.java in ApiController.getPostReplies() does not apply canAccessSpace before returning data from GET /api/posts/{id}/answers. The issue is reachable when scoold.api_user_access_enabled and scoold.api_enabled are true and a token holder knows or enumerates a private question identifier. Under those conditions, the question endpoint can deny access while the answers endpoint returns the private reply bodies, exposing confidential team or project discussions. This issue is fixed in version 1.69.0.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00402 34th percentileScored 2026-11-07
Fix Fixed scoold (Erudika): 1.69.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Erudikascooldbefore 1.69.01.69.0Patch availableCNA
  • scoold VendorErudika Affected before 1.69.0 Fixed in 1.69.0 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:erudika:scoold:*:*:*:*:*:*:*:*——Erudika
  • cpe:2.3:a:erudika:scoold:*:*:*:*:*:*:*:* Versions — — ·Erudika

Remediation

  • Fix · CNA scoold (Erudika) Fixed in 1.69.0

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-54676

References

Other 3

  • TI-2026-30501 Missing authentication in Erudika scoold CVSS 3.1MEDIUM 6.7
  • TI-2026-74990 Scoold accepts forged JWTs as admin, exposing config and logs CVSS 3.1MEDIUM 6.1
  • TI-2026-28342 Scoold has an Authenticated Arbitrary Question Overwrite via Client-Controlled postId in POST /questions/ask CVSS 3.1MEDIUM 6.5
  • TI-2026-27076 Scoold: Cross-Account Feedback Deletion (IDOR) CVSS 3.1MEDIUM 6.5
  • TI-2026-74986 Open redirect in Scoold sign-in lets attackers redirect users CVSS 3.1MEDIUM 5.4
  • TI-2024-33769 Semicolon Path Injection on API /api;/config CVSS 4.0HIGH 8.7
See all 14 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences