Loading vulnerability…
Improper Access Control in Koollab LMS Login Kickout Endpoint
CVE-2026-63235 is an improper access control vulnerability in Koollab LMS 5.3.2 affecting the login kickout endpoint. The endpoint permits unauthenticated requests to terminate active sessions for arbitrary users when the attacker knows or can supply the target user's email address. Because the action is not properly restricted to authorized users or trusted session-management logic, an external attacker can invoke the functionality directly and force logout events for other users. The issue results in a denial-of-service condition against targeted accounts by disrupting authenticated access and ongoing user activity.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation allows an unauthenticated attacker to forcibly terminate the active session of any targeted user whose email address is known. The primary impact is denial of service at the user-account level, including forced logout, interruption of active work, and repeated disruption if the endpoint is abused continuously.
If you can’t patch tonight, do this now.
If immediate code remediation is not possible, restrict external access to the affected session-management functionality, add server-side authentication and authorization enforcement in front of the endpoint, and monitor for anomalous or repeated logout events targeting multiple accounts. Rate limiting and abuse detection can reduce repeated forced-session termination attempts, but they do not fully eliminate the underlying access control flaw.
Patch, then assume compromise.
The vendor reported that fixes were rolled out across all cloud-hosted Koollab LMS instances on 2026-04-26. Remediation requires correcting authorization checks on the login kickout endpoint so that session termination actions can only be performed by the authenticated session owner or by explicitly authorized administrative workflows. Server-side validation should ensure that user-supplied identifiers cannot be used to terminate arbitrary third-party sessions.
No public exploits tracked yet. Mallory keeps watching.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.