SCORM Lab Launch UserID Parameter Validation Bypass in Skillable

Executive Summary

CVE-2026-56877 is a vulnerability in the SCORM lab launch endpoint of Skillable (scorm.skillable.com). The system validates a SCORM launch token for authorization but does not cross-validate the client-supplied userId parameter against the authenticated session token.

An authenticated user can manipulate the userId parameter in the browser to bypass per-user lab launch rate limits. This allows them to consume other users' lab allocations, leading to a denial of service for targeted users by preventing them from accessing their labs or exams.

• The vulnerability exists because the SCORM lab launch flow runs client-side, and the server validates the token but not the userId, which is controlled by the client.
• The same token can be used to launch labs under different userId values, creating separate lab instances and consuming resources allocated to other users.

Skillable, the vendor, acknowledges the issue but considers it an inherent limitation of SCORM rather than an implementation flaw. They have stated that no fix is planned for the SCORM launch path and recommend migrating to an API or LTI 1.3 integration instead.

Useful 0 Not Useful 0

Detection Guidance

Detecting this vulnerability requires monitoring or testing the SCORM lab launch endpoint behavior in Skillable. Since the vulnerability involves client-side manipulation of the userId parameter, you can check for signs of exploitation by analyzing network traffic or logs for unusual patterns.

• Inspect network traffic to the SCORM lab launch endpoint (scorm.skillable.com) for requests containing manipulated userId parameters. Look for multiple lab launch requests with different userId values but the same authentication token.
• Review Skillable logs for anomalies such as repeated lab launches from a single user session or concurrent lab instances associated with different userId values.
• Test for the vulnerability by attempting to launch a lab with a modified userId parameter while authenticated. If the system allows launching labs under different userId values without validation, the vulnerability is present.

No specific commands are provided in the context, but you can use tools like browser developer tools, proxy tools (e.g., Burp Suite, OWASP ZAP), or network monitoring tools (e.g., Wireshark) to observe and manipulate the userId parameter in requests to the SCORM endpoint.

Useful 0 Not Useful 0

Impact Analysis

If you are a user of Skillable's SCORM lab launch service, this vulnerability could impact you in several ways:

• An attacker could bypass lab launch rate limits and consume your lab allocations, preventing you from accessing your own labs or exams.
• You may experience denial of service, where your access to labs or exams is blocked because another user has exhausted your allocated resources.
• There is a potential risk of session data exposure, though this was not independently verified by the reporter.

If you are an organization using Skillable, this vulnerability could disrupt training or certification programs by allowing unauthorized users to deplete lab resources intended for legitimate users.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could have implications for compliance with standards and regulations, depending on the context of its use:

• GDPR: If the vulnerability leads to unauthorized access or manipulation of user data (e.g., session data exposure), it could violate GDPR principles such as data integrity, confidentiality, and lawful processing. Organizations may fail to meet requirements for protecting personal data, potentially leading to non-compliance.
• HIPAA: If Skillable is used in a healthcare context to handle protected health information (PHI), the vulnerability could result in unauthorized access to or disruption of PHI. This may violate HIPAA's Security Rule, which requires safeguards to ensure the confidentiality, integrity, and availability of PHI.
• ISO-27001: The vulnerability undermines security controls related to access management and resource allocation, which are key components of ISO-27001. Organizations relying on Skillable for compliance may face challenges in maintaining their certification if the issue is not addressed.

Skillable itself claims compliance with GDPR and holds certifications like ISO-27001 and SOC 2 Type II. However, this vulnerability could weaken the security posture of organizations using the affected SCORM endpoint, potentially putting them at risk of non-compliance with these standards.

Since Skillable has stated that no fix is planned for the SCORM launch path, organizations may need to migrate to alternative integration methods (e.g., API or LTI 1.3) to maintain compliance.

Useful 0 Not Useful 0

Mitigation Strategies

The vendor, Skillable, has acknowledged the vulnerability but does not plan to fix it for the SCORM launch path. Immediate mitigation steps focus on reducing exposure and migrating to alternative integration methods.

• Migrate from the SCORM lab launch endpoint to an API or LTI 1.3 launch integration, as recommended by Skillable. This removes reliance on the vulnerable client-side userId parameter.
• Monitor lab launch activity for signs of exploitation, such as unusual spikes in lab launches or concurrent instances associated with a single user session.
• Educate users and administrators about the risks of client-side parameter manipulation and the importance of using supported integration methods.
• Review and enforce rate limits or access controls at the organizational level to minimize the impact of potential exploitation.

If migration is not immediately feasible, consider implementing additional monitoring or temporary restrictions on lab launches until a permanent solution is in place.

Useful 0 Not Useful 0