CVE-2026-41243
Received Received - Intake
Information Disclosure in OpenLearn Forum Posts via UUID Access

Publication date: 2026-04-23

Last updated on: 2026-04-29

Assigner: GitHub, Inc.

Description
OpenLearn is open-source educational forum software. Prior to commit 844b2a40a69d0c4911580fe501923f0b391313ab, when `safeMode` is enabled, unapproved forum posts are hidden from the public list, but the direct post-read procedure still returns the full post to anyone with the post UUID. Commit 844b2a40a69d0c4911580fe501923f0b391313ab fixes the issue.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-04-23
Last Modified
2026-04-29
Generated
2026-06-16
AI Q&A
2026-04-24
EPSS Evaluated
2026-06-15
NVD
CVE-2026-41243
EUVD
EUVD-2026-25164
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
siemvk openlearn to 2026-04-14 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-284 The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability affects OpenLearn, an open-source educational forum software. When the safeMode feature is enabled, unapproved forum posts are supposed to be hidden from the public list. However, due to this vulnerability, even though the posts are hidden from the list, anyone with the post's unique identifier (UUID) could still access and read the full content of the unapproved posts. This issue was fixed in a specific commit (844b2a40a69d0c4911580fe501923f0b391313ab).

Impact Analysis

This vulnerability can lead to unauthorized disclosure of unapproved or potentially sensitive forum posts. Even if posts are hidden from the public listing, anyone who knows or obtains the post UUID can access the full content. This could result in exposure of confidential or sensitive information that was not intended for public viewing.

Mitigation Strategies

To mitigate this vulnerability, ensure that your OpenLearn installation is updated to include the fix introduced in commit 844b2a40a69d0c4911580fe501923f0b391313ab. This commit addresses the issue where unapproved forum posts were exposed via direct post-read procedures even when safeMode was enabled.

Until the update is applied, consider restricting access to post UUID endpoints or disabling direct post-read access to unapproved posts to prevent unauthorized data exposure.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-41243. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart