CVE-2026-104050

MediumCVSS 4.3/10Last modified Oct 7, 2026

Description

The Academy LMS WordPress plugin before 4.0.0 does not verify that a quiz question belongs to the course the requesting user is authorized to access before returning that question's answer options, allowing any authenticated user with access to a single course, such as an enrolled student, to read the quiz answer options of questions belonging to other courses they are not enrolled in.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-639

Affected software

No affected versions have been published.

Timeline

Published
Oct 7, 2026
Last modified
Oct 7, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-1040518.2PictShare before 3.7.1 contains an information disclosure vulnerability that allows unauthenticated attackers to obtain the secret delete_coCVE-2026-1040526.3A vulnerability was determined in itsourcecode Pet Shop Management System 1.0. The affected element is an unknown function of the file adminCVE-2026-1040536.3A vulnerability was identified in itsourcecode Pet Shop Management System 1.0. The impacted element is an unknown function of the file adminCVE-2026-1040546.3A security flaw has been discovered in calcom cal.diy up to 6.2.0. This affects the function doesUserIdHaveAccessToBooking of the file BookiCVE-2026-1040555.3The postgresql-operator charm runs a Prometheus postgres_exporter to collect database metrics using a dedicated "monitoring" PostgreSQL userCVE-2026-1040569.8Authlib version 1.7.2 and below contains a vulnerability where discovery JSON metadata is cached without validation or issuer-origin bindingCVE-2026-1040577.5Podgrab contains an unauthenticated denial-of-service vulnerability caused by unsynchronized concurrent access to shared maps (activePlayersCVE-2026-1040585.3Podgrab contains a missing authentication vulnerability in which the /ws WebSocket route is registered on the root gin engine instead of theCVE-2026-1040598.1Lektor 3.3.14 and 3.4.0b15 contains a cross-site request forgery vulnerability in the admin API blueprint that allows unauthenticated attackCVE-2026-1040687.2JetBackup plugin for WordPress before 3.1.24.10 contains a symlink-based arbitrary file write vulnerability that allows an authenticated WorCVE-2026-1040697.2HortusFox before 6.2 contains a remote code execution vulnerability in ThemeModule::startImport() where an uploaded ZIP archive is extractedCVE-2026-1040709.8The Crayons plugin for SPIP before 3.5.0 contains a missing authorization vulnerability that allows unauthenticated attackers to modify arbi