CVE-2026-111603 Details

A missing authorization vulnerability has been identified in PlayEdu versions through 2.3, specifically within the CourseController. This vulnerability allows authenticated students to bypass department restrictions and access courses by omitting the necessary visibility checks. Exploitation involves enumerating course and attachment IDs through the course details and attachment download endpoints, enabling access to course structures and attachment files from other departments.

To address this vulnerability, the department authorization checks should be reinstated on the affected endpoints. This can be done by adding a call to the 'userCanSeeCourseCache.check' method at the beginning of the 'attachmentDownload' and 'detail' methods in the CourseController. Additionally, a regression test should be implemented to ensure that the authorization check is functioning correctly.