CVE-2026-54676 Details
Description
Scoold is a Q&A and a knowledge sharing platform for teams. Prior to 1.69.0, users with personal API tokens can retrieve replies from questions in private spaces they cannot access because src/main/java/com/erudika/scoold/api/ApiController.java in ApiController.getPostReplies() does not apply canAccessSpace before returning data from GET /api/posts/{id}/answers. The issue is reachable when scoold.api_user_access_enabled and scoold.api_enabled are true and a token holder knows or enumerates a private question identifier. Under those conditions, the question endpoint can deny access while the answers endpoint returns the private reply bodies, exposing confidential team or project discussions. This issue is fixed in version 1.69.0.
A vulnerability in Scoold prior to version 1.69.0 allows users with personal API tokens to access replies to questions in private spaces without proper authorization. The issue arises because the 'GET /api/posts/{id}/answers' endpoint fails to check if the user can access the space before returning data. This vulnerability is exploitable when both 'scoold.api_user_access_enabled' and 'scoold.api_enabled' are true, and a token holder knows or can guess a private question ID. As a result, confidential team or project discussions may be exposed.
Users can update to Scoold version 1.69.0 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 17, 2026CISA-ADP
Assessed Sep 18, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/Erudika/scoold/commit/6976afb931d025cf0a35b11d6dff4f699dc87981 | [email protected] | Source CodeVendor |
| https://github.com/Erudika/scoold/releases/tag/1.69.0 | [email protected] | Release NotesVendor |
| https://github.com/Erudika/scoold/security/advisories/GHSA-2cff-ppf7-pc42 | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-862 | Missing Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Erudika Scoold | <= 1.68.2 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 18, 2026 | CVE Modified | CISA-ADP |
| Sep 17, 2026 | New CVE Received | [email protected] |