CVE-2026-97864
Received Received - Intake

Authentication Bypass in GibbonEdu Gibbon

Publication date: 2026-09-25

Last updated on: 2026-09-25

Assigner: VulDB

Description
A vulnerability has been found in GibbonEdu Gibbon up to 30.0.01. The affected element is the function makeBlock of the file modules/Planner/units_add_blockAjax.php of the component Unit Planner. The manipulation of the argument gibbonUnitBlockID/mode leads to missing authentication. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 31.0.00 is sufficient to fix this issue. The identifier of the patch is 07e719368eae8dfb4e22e19424ceab6074164ebc. It is recommended to upgrade the affected component.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-25
Last Modified
2026-09-25
Generated
2026-09-25
AI Q&A
2026-09-25
EPSS Evaluated
N/A
NVD
CVE-2026-97864
EUVD
EUVD-2026-87066

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
gibbonedu gibbon to 30.0.01 (inc)
gibbonedu gibbon 31.0.00

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-287 When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
CWE-306 The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is in GibbonEdu Gibbon up to version 30.0.01. It involves the function makeBlock in the file modules/Planner/units_add_blockAjax.php. The issue allows attackers to bypass authentication by manipulating the gibbonUnitBlockID or mode arguments. This can be exploited remotely without any special privileges.

Detection Guidance

To detect this vulnerability, check if your GibbonEdu Gibbon version is up to 30.0.01 or lower. Inspect the file modules/Planner/units_add_blockAjax.php for the function makeBlock and verify if the gibbonUnitBlockID/mode parameters are exposed without authentication. Look for unauthorized access attempts or unusual activity in the Unit Planner component.

Impact Analysis

An attacker could exploit this to gain unauthorized access to the Gibbon system. This might allow them to view sensitive data, modify settings, or perform actions as if they were a legitimate user. The impact depends on the system's configuration and data stored.

Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive data, violating GDPR and HIPAA requirements. Organizations using affected versions may face compliance violations, potential fines, and reputational damage due to data exposure.

Mitigation Strategies

Immediately upgrade GibbonEdu Gibbon to version 31.0.00 or later. Apply the patch identified by 07e719368eae8dfb4e22e19424ceab6074164ebc. Ensure the affected file modules/Planner/units_add_blockAjax.php is updated and restrict access to the Unit Planner component until the upgrade is complete.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-97864. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart