CVE-2026-39322

Name of the Vulnerable Software and Affected Versions PolarLearn versions 0-PRERELEASE-15 and earlier

Description The software creates a valid session for banned accounts before verifying the supplied password via the /api/v1/auth/sign-in API endpoint. This session is then accepted across authenticated API routes, allowing access to account data and authenticated actions as the banned user. The vulnerable parameter is the password.

Recommendations Update to a version later than 0-PRERELEASE-15.