PT-2026-7166

CVE-2026-25885

Published

2026-02-09

Updated

2026-02-10

Description by

CVSS 4.0

Critical

MetricsAV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L

Name of the Vulnerable Software and Affected Versions PolarLearn versions prior to 0-PRERELEASE-16

Description PolarLearn is a free and open-source learning program. The group chat WebSocket at wss://polarlearn.nl/api/v1/ws can be used without authentication. An unauthenticated client can subscribe to any group chat by providing a group UUID and send messages to any group. The server accepts and stores these messages in the group’s chatContent.

Recommendations Update PolarLearn to version 0-PRERELEASE-16 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Jvr2022

Vendors

Affected products

Weakness enumeration

CWE-285: Improper Authorization

CWE-306: Missing Authentication for Critical Function