CVE-2026-42176 Details
Description
Scoold is a Q&A and a knowledge sharing platform for teams. Prior to version 1.67.0, Scoold allows the admins configuration value to be modified through /api/config/set/admins with a forged Bearer token that is accepted as an admin API token. Once that setting is changed, the target email address is written to the application configuration file. The change does not become active immediately in the current process, because the ADMINS set is loaded once at startup. After a Scoold restart, though, the selected user is recognized as an administrator and gains access to the admin panel. This issue gives an attacker a reliable persistence path: write their own email into scoold.admins, wait for a restart or trigger one operationally, and the account comes back as admin. This issue has been patched in version 1.67.0.
A vulnerability in Scoold prior to version 1.67.0 allows unauthorized modification of the admin configuration value through the API endpoint '/api/config/set/admins'. This is possible by using a forged Bearer token that is accepted as an admin API token. Once the admin setting is changed, the targeted email address is written to the application configuration file. Although the change does not take effect immediately, it becomes active after a restart of the Scoold application, granting the user admin privileges and access to the admin panel. This vulnerability creates a persistent admin takeover, as an attacker can simply overwrite the admin email, wait for a restart, and regain admin access.
Users are advised to update Scoold to version 1.67.0 or later, where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed May 8, 2026CISA-ADP
Assessed May 8, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/Erudika/scoold/security/advisories/GHSA-7qfx-c234-xg4g | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/Erudika/scoold/releases/tag/1.67.0 | [email protected] | Release NotesVendor |
| https://github.com/Erudika/scoold/security/advisories/GHSA-7qfx-c234-xg4g | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-306 | Missing Authentication for Critical Function | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Erudika Scoold | 1.66.2 (semver) |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 8, 2026 | New CVE Received | [email protected] |
| May 8, 2026 | CVE Modified | CISA-ADP |