Missing Authorization in LearnHouse Lets Users Access Other Students' Grades

Executive Summary

This vulnerability is a missing authorization flaw in LearnHouse before version 1.1.1. It allows authenticated users to access other users' grades and submissions by manipulating the user_id parameter in the API endpoints. Attackers can view sensitive academic data like grades, submitted work, and instructor feedback without proper permission checks.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if your LearnHouse instance is running a version before 1.1.1. Inspect API responses for assignment submissions and grades by manipulating user_id parameters. Look for unauthorized access to other users' data without proper authorization checks.

Useful 0 Not Useful 0

Impact Analysis

If you use LearnHouse before 1.1.1, an attacker with an account could access your private grades, submitted assignments, and instructor feedback. This could lead to academic dishonesty, privacy violations, or reputational damage. The impact is limited to users of vulnerable versions of the software.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could violate data protection regulations like GDPR by exposing personal data without authorization. For educational institutions handling student records, it may also conflict with FERPA in the U.S. or other privacy laws. Compliance risks include unauthorized data disclosure and failure to implement proper access controls.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade LearnHouse to version 1.1.1 or later to address the missing authorization flaw. Ensure all API endpoints enforce ownership checks and role-based access control for submissions and grades. Review and update access controls to prevent unauthorized data exposure.

Useful 0 Not Useful 0