CVE-2026-111603
Deferred Deferred - Pending Action

Authenticated Student Access to Department-Restricted Courses in PlayEdu

Publication date: 2026-10-16

Last updated on: 2026-10-16

Assigner: VulnCheck

Description
PlayEdu through 2.3 contains a missing authorization vulnerability in the CourseController that allows authenticated students to access department-restricted courses by omitting the department visibility check. Attackers can enumerate sequential course and attachment IDs via the course details and attachment download endpoints to obtain course structure and attachment files from other departments.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-16
Last Modified
2026-10-16
Generated
2026-10-19
AI Q&A
2026-10-16
EPSS Evaluated
2026-10-18
NVD
CVE-2026-111603
EUVD
EUVD-2026-103025

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
PlayEdu PlayEdu 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

PlayEdu through version 2.3 has a missing authorization vulnerability in the CourseController. Authenticated students can bypass department-based access restrictions to view course structures and attachments from other departments by exploiting endpoints that fail to enforce department visibility checks.

Detection Guidance

To detect this vulnerability, monitor API endpoints for unauthorized access attempts to course details or attachments. Check logs for sequential ID enumeration in requests to GET /api/v1/course/{id} or GET /api/v1/course/{courseId}/attach/{id}/download. Verify if department-restricted courses are accessible by authenticated students without proper authorization checks.

Impact Analysis

Attackers can enumerate sequential course and attachment IDs to access restricted course materials and files from other departments. This exposes sensitive training content, proprietary data, or internal resources meant for specific departments only.

Compliance Impact

This vulnerability may lead to unauthorized access to sensitive data, violating confidentiality requirements in GDPR and HIPAA. It risks exposing protected health information or personal data to unauthorized users, potentially resulting in compliance breaches and legal penalties.

Mitigation Strategies

Immediately update PlayEdu to the latest version beyond 2.3. Ensure the CourseController enforces department-based access controls by adding userCanSeeCourseCache.check to the affected endpoints. Temporarily restrict access to the vulnerable endpoints if an update is not immediately available.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-111603. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart