CVE-2026-63242CWE-639

CVE-2026-63242

Medium · published July 29, 2026

CVSS v3.1
4.3
EPSS
0%
Percentile
16.0
In the wild
Unconfirmed
What it is

A business logic vulnerability in Koollab LMS

allowed an

authenticated learner to set their lesson completion status to completed via

the SCORM commit endpoint without viewing the lesson material, compromising

training and completion records.

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00254 · 16.0th percentile
Weakness
CWE-639 · Authorization Bypass Through User-Controlled Key
Published
2026-07-29T11:16Z
References (1)
https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2026-094/ · 5f57b9bf-260d-4433-bf07-b6a79e9bb7d4
EPSS history
Timeline
  • 29 JUL 06:32Z
    Business logic vulnerability
    cvelistv5