CVE-2026-63236
LowCVSS 3.7Exploitation Probability (EPSS)
Low risk6th percentile - higher than 6% of all known CVEs
Summary
An improper access control vulnerability in Koollab LMS allowed an unauthenticated attacker to read another user's name, internal identifier, scores, lesson status, lesson position, and cached lesson state via the SCORM API endpoint.
Risk Assessment
The organization risks leakage of sensitive user data, including scores and learning progress, potentially compromising privacy and system integrity.
Recommendation
Update Koollab LMS and implement strict authentication and authorization for SCORM API endpoints.
Original NVD description (English source)
An improper access control vulnerability in Koollab LMS allowed an unauthenticated attacker to read another user's name, internal identifier, scores, lesson status, lesson position, and cached lesson state via the SCORM API endpoint.