CVE-2026-57183 Details
Description
Scoold is a Q&A and a knowledge sharing platform for teams. Prior to 1.69.1, checkApiAuth() in src/main/java/com/erudika/scoold/utils/ScooldUtils.java accepts a JWT signed with app_secret_key or para_secret_key for /api/config and /api/stats without requiring a registered API-key jti, and maps the request to the hardcoded administrative API_USER. The special endpoint checks run even when scoold.api_enabled is false. An attacker who obtains either signing secret can forge a token that reads sensitive configuration and server logs and reaches privileged configuration functionality, while an ordinary login-session token is not sufficient. This issue is fixed in version 1.69.1.
A vulnerability in Scoold versions prior to 1.69.1 allows for authentication bypass via forged JSON Web Tokens (JWTs). The issue arises in the 'checkApiAuth()' function, where JWTs signed with the application or Para secret keys are accepted as valid admin API tokens for endpoints '/api/config' and '/api/stats'. This acceptance occurs even when the API is disabled in the configuration. An attacker with access to either secret key can exploit this to read sensitive configuration data, server logs, and manipulate privileged settings, potentially leading to a full application takeover.
Users can update to Scoold version 1.69.1 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 15, 2026CISA-ADP
Assessed Oct 28, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/Erudika/scoold/security/advisories/GHSA-6q9q-cqq5-hvmq | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/Erudika/scoold/commit/de018c17a60c352f318109a762a377c325a5fd97 | [email protected] | Source CodeVendor |
| https://github.com/Erudika/scoold/commit/e527d4da1ac04b6a35bd86e560c279f0160c5c02 | [email protected] | Source CodeVendor |
| https://github.com/Erudika/scoold/releases/tag/1.69.1 | [email protected] | Release NotesVendor |
| https://github.com/Erudika/scoold/security/advisories/GHSA-6q9q-cqq5-hvmq | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-287 | Improper Authentication | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Erudika Scoold | 1.66.2 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 28, 2026 | CVE Modified | CISA-ADP |
| Oct 15, 2026 | New CVE Received | [email protected] |