CVE-2026-63241

Deferred Deferred - Pending Action

BaseFortify

Publication date: 2026-07-29

Last updated on: 2026-07-30

Assigner: CSA

Description

An insecure direct object reference vulnerability in Koollab LMS allowed an authenticated user to query the course completion progress of any other user without authorisation, disclosing private learning progress information.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-29

Last Modified

2026-07-30

Generated

2026-10-18

AI Q&A

2026-07-29

EPSS Evaluated

2026-10-16

NVD

CVE-2026-63241

EUVD

EUVD-2026-50136

Affected Vendors & Products

Vendor	Product	Version / Range
Three	Learning	Koollab LMS 5.3.2

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-639	The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

Executive Summary

This vulnerability is an insecure direct object reference in Koollab LMS. It allows an authenticated user to view the course completion progress of any other user without proper authorization, which means private learning progress information is exposed.

Detection Guidance

This vulnerability involves unauthorized access to course completion progress in Koollab LMS. To detect it, review application logs for unusual queries accessing user progress data without proper authorization. Check for repeated requests to endpoints handling user progress, especially from non-admin accounts. Monitor database queries for direct object references to user progress tables accessed by unauthorized roles.

Impact Analysis

If you use Koollab LMS, your course completion progress and private learning data could be accessed by other users without your consent. This breaches confidentiality and may lead to misuse of personal information.

Compliance Impact

This vulnerability likely violates GDPR as it involves unauthorized access to personal data and could lead to privacy breaches. It may also conflict with HIPAA if protected health information is involved, as unauthorized disclosure is prohibited.

Mitigation Strategies

Implement proper authorization checks to ensure users can only access their own course completion progress. Review and update access controls in Koollab LMS to prevent unauthorized data queries.

Hi! I’m here to help you understand CVE-2026-63241. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70