Read the docs
TI-2026-74990 Aliases CVE-2026-57183

Scoold accepts forged JWTs as admin, exposing config and logs

Priority MEDIUM 62CWE-287Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
Required
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-287.

Summary

Scoold before 1.69.1 accepts JWTs signed with the app_secret_key or para_secret_key for its admin API without checking a registered API key (CWE-287). An attacker who obtains either signing secret can forge a token that maps to a hardcoded administrative user, reading sensitive configuration and server logs and reaching privileged configuration functions. An ordinary login session token is not sufficient, and the checks apply even when the API is disabled.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

Scoold is a Q&A and a knowledge sharing platform for teams. Prior to 1.69.1, checkApiAuth() in src/main/java/com/erudika/scoold/utils/ScooldUtils.java accepts a JWT signed with app_secret_key or para_secret_key for /api/config and /api/stats without requiring a registered API-key jti, and maps the request to the hardcoded administrative API_USER. The special endpoint checks run even when scoold.api_enabled is false. An attacker who obtains either signing secret can forge a token that reads sensitive configuration and server logs and reaches privileged configuration functionality, while an ordinary login-session token is not sufficient. This issue is fixed in version 1.69.1.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00296 22nd percentileScored 2026-11-07
Fix Fixed scoold (Erudika): 1.69.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Erudikascooldbefore 1.69.11.69.1Patch availableCNA
  • scoold VendorErudika Affected before 1.69.1 Fixed in 1.69.1 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:erudika:scoold:*:*:*:*:*:*:*:*——Erudika
  • cpe:2.3:a:erudika:scoold:*:*:*:*:*:*:*:* Versions — — ·Erudika

Remediation

Update Scoold to version 1.69.1, which fixes this issue.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

  • Fix · CNA scoold (Erudika) Fixed in 1.69.1

Timeline

  1. 2026-10-16 Threatist record created from CVE-2026-57183
  2. 2026-10-16 Priority changed: MEDIUM → LOW
  3. 2026-10-28 CISA SSVC decision points changed
  4. 2026-10-28 Priority changed: LOW → MEDIUM

References

Other 4

  • TI-2026-30501 Missing authentication in Erudika scoold CVSS 3.1MEDIUM 6.7
  • TI-2026-28342 Scoold has an Authenticated Arbitrary Question Overwrite via Client-Controlled postId in POST /questions/ask CVSS 3.1MEDIUM 6.5
  • TI-2026-27076 Scoold: Cross-Account Feedback Deletion (IDOR) CVSS 3.1MEDIUM 6.5
  • TI-2026-74986 Open redirect in Scoold sign-in lets attackers redirect users CVSS 3.1MEDIUM 5.4
  • TI-2024-33769 Semicolon Path Injection on API /api;/config CVSS 4.0HIGH 8.7
  • TI-2022-01415 Improper handling of Length parameter in erudika/scoold CVSS 3.1HIGH 8.8
See all 14 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences