CVE-2026-54677

Overview

Scoold prior to version 1.69.0 contains an authorization bypass vulnerability in the QuestionController and CommentController components. Authenticated non-members can create content in private spaces due to missing canAccessSpace checks. This allows unauthorized modification of private discussions and leaks metadata via notifications.

Description

Scoold is a Q&A and a knowledge sharing platform for teams. Prior to 1.69.0, authenticated users who are not members of a private space can create content in questions belonging to that space because src/main/java/com/erudika/scoold/controllers/QuestionController.java in QuestionController.reply() and src/main/java/com/erudika/scoold/controllers/CommentController.java in CommentController.createAjax() do not apply the canAccessSpace authorization check used by the question read path. With scoold.is_default_space_public set to false and private spaces in use, a user with a valid session and a known or enumerable question identifier can send requests to POST /question/{id} and POST /comment, causing replies and comments to be stored in a thread the user cannot read. This permits unauthorized modification of private discussions and can trigger notifications that reveal the existence or metadata of private activity. This issue is fixed in version 1.69.0.

Impact

This vulnerability impacts the confidentiality and integrity of private spaces within the knowledge sharing platform. Authenticated attackers without explicit space membership can inject comments and replies into restricted threads. This also triggers unintended notifications that may expose the existence of private organizational data to unauthorized users.

Remediation

Upgrade the Scoold platform to version 1.69.0 or later where the missing canAccessSpace authorization checks have been properly implemented. Ensure default space configurations and private space policies are reviewed in accordance with organizational security requirements.

Risk context

Rated as a medium severity issue with a CVSS score of 6.5, this vulnerability requires an authenticated session and knowledge of specific question identifiers to exploit. While EPSS data is not present, defenders should prioritize patching if private spaces are heavily utilized.

Affected products

• Scoold < 1.69.0
• Erudika Scoold