CVE-2026-25885

PolarLearn is a free and open-source learning program. In 0-PRERELEASE-16 and earlier, the group chat WebSocket at wss://polarlearn.nl/api/v1/ws can be used without logging in. An unauthenticated client can subscribe to any group chat by providing a group UUID, and can also send messages to any group. The server accepts the message and stores it in the group’s chatContent, so this is not just a visual spam issue.

• CWE-285
• CWE-306

• https://github.com/polarnl/PolarLearn/commit/3ba588fda0d3f8e238483a20772719f27e52e79fPatch
• https://github.com/polarnl/PolarLearn/security/advisories/GHSA-gvjm-5pw7-6c8cExploit, Vendor Advisory

Published

Feb 9, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-2588Crypt::NaCl::Sodium versions through 2.001 for Perl has an i…9.1
• CVE-2026-25880SumatraPDF is a multi-format reader for Windows. In 3.5.2 an…7.8
• CVE-2026-25881SandboxJS is a JavaScript sandboxing library. Prior to 0.8.3…10
• CVE-2026-25882Fiber is an Express inspired web framework written in Go. A …7.5
• CVE-2026-25883Vexa is an open-source, self-hostable meeting bot API and me…5.8
• CVE-2026-25884Exiv2 is a C++ library and a command-line utility to read, w…8.1
• CVE-2026-25887Chartbrew is an open-source web application that can connect…7.2
• CVE-2026-25888Chartbrew is an open-source web application that can connect…8.8
• CVE-2026-25889File Browser provides a file managing interface within a spe…5.4
• CVE-2026-2589The Greenshift – animation and page builder blocks plugin fo…5.3
• CVE-2026-25890File Browser provides a file managing interface within a spe…8.1
• CVE-2026-25891Fiber is an Express inspired web framework written in Go. A …7.5