PT-2026-134518

CVE-2026-120199

·

Published

2026-10-31

·

Updated

2026-10-31

Description by

CVSS 3.1
4.3
Medium
MetricsAV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
LearnHouse before 1.1.1 contains a missing authorization vulnerability in the assignment API that allows authenticated users to read other users' grades and submissions. Attackers can supply another user id to the submissions grade endpoint or query submission read functions to view other students' work, grades and instructor feedback.
Exploitability
Fix
Impacts
Researchers
Vendors
Affected products
Weakness enumeration
CWE-639: Authorization Bypass Through User-Controlled Key
Related identifiers
CVE-2026-120199
Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com