CVE-2026-41243

Received Received - Intake

Information Disclosure in OpenLearn Forum Posts via UUID Access

Publication date: 2026-04-23

Last updated on: 2026-04-29

Assigner: GitHub, Inc.

Description

OpenLearn is open-source educational forum software. Prior to commit 844b2a40a69d0c4911580fe501923f0b391313ab, when `safeMode` is enabled, unapproved forum posts are hidden from the public list, but the direct post-read procedure still returns the full post to anyone with the post UUID. Commit 844b2a40a69d0c4911580fe501923f0b391313ab fixes the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-04-23

Last Modified

2026-04-29

Generated

2026-07-06

AI Q&A

2026-04-24

EPSS Evaluated

2026-07-05

NVD

CVE-2026-41243

EUVD

EUVD-2026-25164

Affected Vendors & Products

Vendor	Product	Version / Range
siemvk	openlearn	to 2026-04-14 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-284	The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Attack-Flow Graph

Mitigation Strategies

To mitigate this vulnerability, ensure that your OpenLearn installation is updated to include the fix introduced in commit 844b2a40a69d0c4911580fe501923f0b391313ab. This commit addresses the issue where unapproved forum posts were exposed via direct post-read procedures even when safeMode was enabled.

Until the update is applied, consider restricting access to post UUID endpoints or disabling direct post-read access to unapproved posts to prevent unauthorized data exposure.

Executive Summary

This vulnerability affects OpenLearn, an open-source educational forum software. When the safeMode feature is enabled, unapproved forum posts are supposed to be hidden from the public list. However, due to this vulnerability, even though the posts are hidden from the list, anyone with the post's unique identifier (UUID) could still access and read the full content of the unapproved posts. This issue was fixed in a specific commit (844b2a40a69d0c4911580fe501923f0b391313ab).

Impact Analysis

This vulnerability can lead to unauthorized disclosure of unapproved or potentially sensitive forum posts. Even if posts are hidden from the public listing, anyone who knows or obtains the post UUID can access the full content. This could result in exposure of confidential or sensitive information that was not intended for public viewing.

Hi! I’m here to help you understand CVE-2026-41243. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70