CVE-2026-63235CWE-284broken-access-control

CVE-2026-63235

Low · published July 29, 2026

CVSS v3.1
3.7
EPSS
0%
Percentile
22.9
In the wild
Unconfirmed
What it is

An improper access control vulnerability in Koollab LMS

allowed an

unauthenticated attacker to forcibly terminate the session of any user given

their email address via the login kickout endpoint, resulting in a denial of

service.

The record
Technical detail
CVSS v3.1
3.7 · LOW
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
CVSS v4.0
Not supplied
EPSS
0.00312 · 22.9th percentile
Weakness
CWE-284 · Improper Access Control
Published
2026-07-29T11:16Z
References (1)
https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2026-094/ · 5f57b9bf-260d-4433-bf07-b6a79e9bb7d4
EPSS history
Timeline
  • 29 JUL 06:23Z
    Improper access control vulnerability
    cvelistv5