Read the docs
TI-2026-83549 Aliases CVE-2026-120199GHSA-3gfx-j948-6jm4

Missing authorization in LearnHouse assignment submissions API

Priority LOW 23CWE-639Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
Low · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-639.

Summary

LearnHouse before 1.1.1 contains a missing authorization flaw in its assignment API (CWE-639) that lets any authenticated user read other users' grades and submissions. An attacker with low privileges can supply another user_id to the submissions grade endpoint or query submission read functions to view other students' work, grades and instructor feedback.

Written with Claude Haiku 5.5 from the sources below · 2026-11-01

Description from the CNA

LearnHouse before 1.1.1 contains a missing authorization vulnerability in the assignment API that allows authenticated users to read other users' grades and submissions. Attackers can supply another user_id to the submissions grade endpoint or query submission read functions to view other students' work, grades and instructor feedback.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00218 12th percentileScored 2026-11-07
Fix Fixed learnhouse (learnhouse): 1.1.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
learnhouselearnhousebefore 1.1.11.1.1Patch availableCNA
  • learnhouse Vendorlearnhouse Affected before 1.1.1 Fixed in 1.1.1 Patch available CNA

Remediation

Upgrade LearnHouse to version 1.1.1 or later, which fixes the flaw.

Written with Claude Haiku 5.5 from the sources below · 2026-11-01

  • Fix · CNA learnhouse (learnhouse) Fixed in 1.1.1

Timeline

  1. 2026-10-31 Threatist record created from CVE-2026-120199
  2. 2026-10-31 Alias added: GHSA-3gfx-j948-6jm4
  3. 2026-11-06 CISA SSVC decision points changed

References

Patch 2

Other 3

  • TI-2025-11259 LearnHouse Image information disclosure CVSS 4.0MEDIUM 5.3
  • TI-2025-11253 LearnHouse Student Assignment Submission sub_file resource injection CVSS 4.0MEDIUM 5.3
  • TI-2025-11251 LearnHouse Course Thumbnail courses unrestricted upload CVSS 4.0MEDIUM 5.3
  • TI-2025-11252 LearnHouse Account Setting previews cross site scripting CVSS 4.0MEDIUM 5.1
  • TI-2026-71294 Missing authorization lets users copy restricted LearnHouse playgrounds CVSS 4.0LOW 2.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences