CVE-2026-56877 - Skillable SCORM userId authorisation bypass

Kurzinfo

Metadaten

Original (extern): Link oeffnen
Veroeffentlicht: 2026-07-16 04:41 UTC
Importiert: 2026-07-23 03:15 UTC
CVSS: 6.3
Quelle-ID: full_disc
uid_hash: c432c2c1eb449118db216c122d9ad5231f31b70b5e2914f9d28d8582881b93f4

Full Disclosure

Posted by Greg via Fulldisclosure on Jul 15 Skillable's SCORM lab launch endpoint validates a launch token but

enforces per-user allocation limits using a browser-supplied userId

that is not bound to the validated token. An authenticated learner

can modify this identifier to bypass configured limits, launch

concurrent lab instances, and consume another learner's allocation.

Skillable states that no fix is planned for the legacy SCORM launch

path. CVE-2026-56877 was assigned by...

CVE-ID	Severity (Quelle)	CVSS (Quelle)	Severity (CVE.org)	CVSS (CVE.org)	EPSS	EPSS-Pctl	Veroeffentlicht (CVE.org)
CVE-2026-56877	MEDIUM	6.3	MEDIUM	6.3			2026-07-13

Bezeichnung	Name	Kategorie	Tags	Zielgruppe	Sprache	Feed-URL
Full Disclosure	full_disc	threat_intel		-	de	https://seclists.org/rss/fulldisclosure.rss