CVE Catalog
CVE-2026-63235
LowCVSS 3.7Exploitation Probability (EPSS)
Low risk0.20%
10th percentile - higher than 10% of all known CVEs
Summary
An unauthenticated attacker can forcibly terminate the session of any Koollab LMS user by knowing their email address via the login kickout endpoint, leading to denial of service.
Risk Assessment
The organization is exposed to intentional session disruption, potentially impacting work and LMS availability.
Recommendation
Update Koollab LMS to a patched version and consider restricting access to the kickout endpoint.
Original NVD description (English source)
An improper access control vulnerability in Koollab LMS allowed an unauthenticated attacker to forcibly terminate the session of any user given their email address via the login kickout endpoint, resulting in a denial of service.