CVE-2026-63241

LOW

Three Learning Koollab LMS - Insecure Direct Object Reference Vulnerability

Title source: rule

Description

An insecure direct object reference vulnerability in Koollab LMS allowed an authenticated user to query the course completion progress of any other user without authorisation, disclosing private learning progress information.

References (1)

Core 1

Core References

https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2026-094/

Scores

CVSS v3 3.1

EPSS 0.0014

EPSS Percentile 3.8%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

CWE

CWE-639

Status published

Products (1)

Three Learning/Koollab LMS 5.3.2

Published Jul 29, 2026

Tracked Since Jul 29, 2026