Loading vulnerability…
IDOR in Koollab LMS Course Completion Progress
CVE-2026-63241 is an insecure direct object reference vulnerability in Koollab LMS 5.3.2. The flaw allows an authenticated user to query the course completion progress of another user without proper authorization checks. The vulnerable behavior stems from direct access to user-associated progress data based on a supplied identifier, without adequately verifying that the requesting user is permitted to view the referenced user's records. The issue results in disclosure of private learning progress information.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation allows an authenticated user to access other users' course completion progress information without authorization. This compromises confidentiality of learner activity and progress data and may expose private educational or training status information across tenants or user populations accessible through the affected application context.
If you can’t patch tonight, do this now.
If vendor remediation is not yet confirmed in a given deployment context, restrict access to progress-query functionality to only necessary roles, review and harden authorization logic around user-object lookups, and monitor for anomalous access patterns involving repeated requests for other users' progress data. Additional compensating controls include detailed audit logging for progress-data access and alerting on enumeration behavior by authenticated accounts.
Patch, then assume compromise.
Vendor fixes were rolled out for affected Koollab LMS cloud-hosted instances on 2026-04-26. Remediation requires enforcing server-side authorization checks on every request for course progress data so that users can access only their own records or records explicitly permitted by role-based access controls. Object references tied to user progress should be validated against the authenticated session and least-privilege access rules.
No public exploits tracked yet. Mallory keeps watching.
1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.