Description
Instructure Canvas LMS didn't properly deny access to locked/unpublished files when the unprivileged user access the DocViewer based file preview URL (canvadoc_session_url).
References (2)
Core 2
Core References
Exploit, Third Party Advisory
https://github.com/gaukas/instructure-canvas-file-oracle
Exploit, Third Party Advisory
https://github.com/instructure/canvas-lms/issues/1905
Scores
CVSS v3
6.5
EPSS
0.0027
EPSS Percentile
49.9%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Details
CWE
CWE-639
Status
published
Products (1)
instructure/canvas_learning_management_service
< 2022-10-15
Published
Jan 26, 2023
Tracked Since
Feb 18, 2026