CVE-2026-41243
Information Disclosure in OpenLearn Forum Posts via UUID Access
Publication date: 2026-04-23
Last updated on: 2026-04-29
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| siemvk | openlearn | to 2026-04-14 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-284 | The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor. |
Attack-Flow Graph
AI Powered Q&A
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, ensure that your OpenLearn installation is updated to include the fix introduced in commit 844b2a40a69d0c4911580fe501923f0b391313ab. This commit addresses the issue where unapproved forum posts were exposed via direct post-read procedures even when safeMode was enabled.
Until the update is applied, consider restricting access to post UUID endpoints or disabling direct post-read access to unapproved posts to prevent unauthorized data exposure.
Can you explain this vulnerability to me?
This vulnerability affects OpenLearn, an open-source educational forum software. When the safeMode feature is enabled, unapproved forum posts are supposed to be hidden from the public list. However, due to this vulnerability, even though the posts are hidden from the list, anyone with the post's unique identifier (UUID) could still access and read the full content of the unapproved posts. This issue was fixed in a specific commit (844b2a40a69d0c4911580fe501923f0b391313ab).
How can this vulnerability impact me? :
This vulnerability can lead to unauthorized disclosure of unapproved or potentially sensitive forum posts. Even if posts are hidden from the public listing, anyone who knows or obtains the post UUID can access the full content. This could result in exposure of confidential or sensitive information that was not intended for public viewing.