CVE Catalog
CVE-2026-63241
LowCVSS 3.1Exploitation Probability (EPSS)
Low risk0.14%
4th percentile - higher than 4% of all known CVEs
Summary
An insecure direct object reference vulnerability in Koollab LMS allowed an authenticated user to query the course completion progress of any other user without authorisation, disclosing private learning progress information.
Risk Assessment
The organization risks user privacy breaches by exposing their learning progress, potentially leading to legal issues and loss of trust.
Recommendation
Update Koollab LMS and implement proper access controls on course progress endpoints.
Original NVD description (English source)
An insecure direct object reference vulnerability in Koollab LMS allowed an authenticated user to query the course completion progress of any other user without authorisation, disclosing private learning progress information.