CVE-2026-109564

Received Received - Intake

Missing Authorization in LearnHouse Playground Duplication

Publication date: 2026-10-12

Last updated on: 2026-10-12

Assigner: VulnCheck

Description

LearnHouse before 1.4.0 contains a missing authorization vulnerability in POST /api/v1/playgrounds/{uuid}/duplicate that skips the read-access and draft checks enforced by get_playground. Authenticated users with playground creation rights, such as Instructors, who know a RESTRICTED or unpublished playground UUID can copy its html_content and republish it publicly.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-12

Last Modified

2026-10-12

Generated

2026-10-13

AI Q&A

2026-10-13

EPSS Evaluated

N/A

NVD

CVE-2026-109564

Affected Vendors & Products

Vendor	Product	Version / Range
learnhouse	LearnHouse	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

LearnHouse before version 1.4.0 has a missing authorization vulnerability in the endpoint POST /api/v1/playgrounds/{uuid}/duplicate. This flaw allows authenticated users with playground creation rights, such as Instructors, to bypass read-access and draft checks enforced by the get_playground function. By knowing the UUID of a restricted or unpublished playground, they can duplicate its html_content and republish it publicly.

Detection Guidance

Check for unauthorized duplication of restricted or unpublished playgrounds by monitoring API logs for POST requests to /api/v1/playgrounds/{uuid}/duplicate. Look for requests from authenticated users with playground creation rights accessing UUIDs they should not have access to.

Impact Analysis

If you are an authenticated user with playground creation rights, such as an Instructor, this vulnerability could allow you to access and duplicate restricted or unpublished content. If you are an administrator or user relying on content restrictions, unauthorized duplication of sensitive or draft content may lead to data leaks or improper sharing of proprietary information.

Compliance Impact

This vulnerability could lead to unauthorized access and duplication of sensitive data, potentially violating confidentiality requirements under GDPR and HIPAA. If restricted or unpublished content contains personal or protected health information, its unauthorized duplication and public exposure could result in non-compliance with data protection regulations.

Mitigation Strategies

Upgrade LearnHouse to version 1.4.0 or later to address the missing authorization flaw. Review and restrict playground creation rights to only necessary users. Audit existing playgrounds for unauthorized duplicates and remove any public copies of restricted content.

Hi! I’m here to help you understand CVE-2026-109564. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70