Loading vulnerability…
Information Disclosure in Koollab LMS Course Status Endpoint
CVE-2026-63240 is an information disclosure vulnerability in Koollab LMS 5.3.2. The flaw allows an authenticated learner to retrieve correct quiz answers from the course status endpoint without legitimately completing the assessment workflow. By exposing answer data to a user who should not yet have access to it, the vulnerable endpoint breaks assessment confidentiality and enables unauthorized access to protected quiz content.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation allows a learner with valid authenticated access to disclose correct answers for quizzes or assessments before completing them as intended. The primary impact is compromise of assessment integrity, enabling cheating and undermining the reliability of grading, certification, and training outcomes. The issue does not indicate code execution or privilege escalation, but it does expose protected educational content to unauthorized users within the application.
If you can’t patch tonight, do this now.
If immediate remediation cannot be verified, restrict learner access to assessment-related status functionality where operationally feasible, review authorization controls around endpoints that return assessment state, and monitor for abnormal access patterns involving quiz status retrieval. Additional compensating controls include validating that answer data is only returned after the intended completion state is reached and limiting exposed assessment metadata to the minimum necessary for the learner role.
Patch, then assume compromise.
The vendor rolled out fixes across all cloud-hosted Koollab LMS instances on 2026-04-26. Because Koollab LMS is delivered as a SaaS platform, no customer-side patching or manual update is required. Remediation consists of ensuring the service is running the vendor-corrected version in which the course status endpoint no longer exposes correct quiz answers to learners prior to legitimate completion.
No public exploits tracked yet. Mallory keeps watching.
1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.