CVE-2026-63240
Last modified
CVE-2026-63240 is a medium-severity vulnerability rated 4.3/10 on the CVSS scale. An information disclosure vulnerability in Koollab LMS allowed an authenticated learner to obtain correct quiz answers from the course status endpoint without completing the assessment legitimately, compromising the integrity of assessments.. EPSS estimates a 0.18% chance of exploitation in the next 30 days.
Description
An information disclosure vulnerability in Koollab LMS allowed an authenticated learner to obtain correct quiz answers from the course status endpoint without completing the assessment legitimately, compromising the integrity of assessments.
Metrics
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| Three Learning | Koollab LMS | 5.3.2 |
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2026-63240?
How severe is CVE-2026-63240?
How do I fix CVE-2026-63240?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-63235An improper access control vulnerability in Koollab LMS allo…3.7
- CVE-2026-63236An improper access control vulnerability in Koollab LMS allo…3.7
- CVE-2026-63237A TOTP two-factor authentication bypass vulnerability in Koo…4.8
- CVE-2026-63238An authentication bypass vulnerability in Koollab LMS allowe…6.5
- CVE-2026-63239A hard-coded AWS IAM credentials vulnerability in Koollab LM…5.4
- CVE-2026-6324A flaw was found in libsoup. A remote attacker could exploit…4.8
- CVE-2026-63241An insecure direct object reference vulnerability in Koollab…3.1
- CVE-2026-63242A business logic vulnerability in Koollab LMS allowed an aut…4.3
- CVE-2026-63248In Eclipse Milo versions 0.6.0 through 1.1.4, OPC UA server …6.5
- CVE-2026-6325Out-of-bounds write in SetSuitesHashSigAlgo when processing …7.5
- CVE-2026-63252In Eclipse Milo versions 0.6.0 through 1.1.4, UASC server tr…7.5
- CVE-2026-63259Authorization Bypass Through User-Controlled Key (CWE-639) i…4.3
Are you affected by CVE-2026-63240?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST