CVE-2026-55842

Name of the Vulnerable Software and Affected Versions Scoold versions prior to 1.69.1

Description The apiCorsConfiguration() function in src/main/java/com/erudika/scoold/ScooldServer.java incorrectly combines addAllowedOriginPattern("*") with setAllowCredentials(true). This configuration causes the application to reflect any requesting origin while permitting the use of cookies or session tokens. Consequently, a malicious website visited by an authenticated user can perform authenticated API requests to read user data, questions, and configuration, or execute state-changing operations on behalf of the user.

Recommendations Update to version 1.69.1.