CVE-2026-55842

Deferred Deferred - Pending Action

Cross-Site Request Forgery in Scoold Platform

Publication date: 2026-10-15

Last updated on: 2026-10-16

Assigner: GitHub, Inc.

Description

Scoold is a Q&A and a knowledge sharing platform for teams. Prior to 1.69.1, the apiCorsConfiguration() method in src/main/java/com/erudika/scoold/ScooldServer.java combines addAllowedOriginPattern("*") with setAllowCredentials(true), causing Spring to reflect any requesting origin while allowing cookies or session tokens. A malicious website visited by a logged-in Scoold user can therefore issue authenticated API requests, read user data, questions, and configuration, and trigger state-changing operations on the user's behalf. This issue is fixed in version 1.69.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-15

Last Modified

2026-10-16

Generated

2026-10-19

AI Q&A

2026-10-16

EPSS Evaluated

2026-10-18

NVD

CVE-2026-55842

EUVD

EUVD-2026-102311

Affected Vendors & Products

Vendor	Product	Version / Range
Erudika	scoold	< 1.69.1

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-346	The product does not properly verify that the source of data or communication is valid.
CWE-942	The product uses a web-client protection mechanism such as a Content Security Policy (CSP) or cross-domain policy file, but the policy includes untrusted domains with which the web client is allowed to communicate.

Attack-Flow Graph

Executive Summary

This vulnerability is a Cross-Origin Resource Sharing (CORS) misconfiguration in Scoold versions before 1.69.1. The API incorrectly uses a wildcard origin (*) combined with allowing credentials, which lets any website make authenticated API requests on behalf of logged-in users. This exposes sensitive data like user information, questions, and configurations.

Detection Guidance

Check if your Scoold instance is running a vulnerable version (<=1.69.0) by inspecting the server version or changelog. Verify CORS configuration in ScooldServer.java for wildcard origin (*) combined with setAllowCredentials(true). Use browser developer tools to inspect network requests for Access-Control-Allow-Origin and Access-Control-Allow-Credentials headers.

Impact Analysis

If you are a Scoold user, a malicious website you visit could steal your data, read your questions or configurations, or perform actions like creating or deleting posts while pretending to be you. Attackers could exfiltrate sensitive information or manipulate your account without your knowledge.

Compliance Impact

This vulnerability could lead to unauthorized access to personal data, violating GDPR's data protection principles and HIPAA's requirements for safeguarding protected health information. It may result in non-compliance due to unauthorized data exposure and lack of proper access controls.

Mitigation Strategies

Upgrade to Scoold version 1.69.1 or later. Configure the new cors_allowed_origins parameter with explicit trusted domains instead of using a wildcard. If public access is needed, use a separate endpoint without credential support. Review and restrict CORS headers in responses.

Hi! I’m here to help you understand CVE-2026-55842. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70