CVE-2026-54677

Name of the Vulnerable Software and Affected Versions Scoold versions prior to 1.69.0

Description Authenticated users who are not members of a private space can create content in questions belonging to that space. This occurs because the reply() function in QuestionController.java and the createAjax() function in CommentController.java fail to apply the canAccessSpace authorization check. When scoold.is default space public is set to false and private spaces are active, a user with a valid session and a known or enumerable question identifier can send requests to the endpoints 'POST /question/{id}' and 'POST /comment'. This allows unauthorized modification of private discussions and may trigger notifications that reveal metadata or the existence of private activity.

Recommendations Update to version 1.69.0.