CVE-2026-63236

Improper access control vulnerability

Low · published July 29, 2026

CVSS v3.1
3.7
EPSS
0%
Percentile
17.0
In the wild
Unconfirmed
What it is

An improper access control vulnerability in

Koollab LMS allowed an

unauthenticated attacker to read another user's name, internal identifier,

scores, lesson status, lesson position, and cached lesson state via the SCORM

API endpoint.

The record
Technical detail
CVSS v3.1
3.7 · LOW
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00262 · 17.0th percentile
Published
2026-07-29T06:24Z
EPSS history
Timeline
  • 29 JUL 06:24Z
    Improper access control vulnerability
    cvelistv5