CVE-2026-109564

3.1Low

Published 12 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash

3.1Low

Attack vector: Network
Complexity: High
Privileges needed: Low
User interaction: None
Impact: Limited impact
Weakness: CWE-862

Impact

Authenticated users like Instructors can access and republish private or unpublished playground content. The attacker needs an account with playground creation privileges and the target playground's UUID.

Root cause

The duplicate endpoint fails to perform read-access and draft status checks on the source playground before copying its contents.

Affected systems

LearnHouse versions prior to 1.4.0

CVSS v3.1 · CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N

Fix & remediation

Upgrade LearnHouse to version 1.4.0 or later. If patching immediately is not possible, block or restrict access to the POST /api/v1/playgrounds/{uuid}/duplicate endpoint at your reverse proxy.

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

LearnHouse before 1.4.0 contains a missing authorization vulnerability in POST /api/v1/playgrounds/{uuid}/duplicate that skips the read-access and draft checks enforced by get_playground. Authenticated users with playground creation rights, such as Instructors, who know a RESTRICTED or unpublished playground UUID can copy its html_content and republish it publicly.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-109564