CVE-2026-56877

MediumCVSS 6.3/10Last modified Oct 24, 2026

Description

The SCORM lab launch endpoint in Skillable (scorm.skillable.com) through 2026-07-13 does not validate the client-supplied userId parameter against the authenticated SCORM session token. An authenticated user can substitute arbitrary userId values to bypass per-user lab launch rate limits and consume other users' lab allocations, resulting in denial of service against targeted users' lab and exam access. Skillable was formerly named Learn on Demand Systems.

Metrics

CVSS 3.1 6.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-472

Affected software

No affected versions have been published.

Timeline

Published: Jul 13, 2026
Last modified: Oct 24, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-568796.7In gmc_mb_msg_handler of gmc_mba.c, there is a possible memory corruption due to a confused deputy. This could lead to local escalation of p CVE-2026-56887.3A security vulnerability has been detected in Totolink A7100RU 7.4cu.2313_b20191024. Impacted is the function setDdnsCfg of the file /cgi-bi CVE-2026-568818.4In enable_segment of remap.c, there is a possible permission bypass due to a logic error in the code. This could lead to local escalation of CVE-2026-568828.8In Cellular Modem, there is a possible information disclosure due to a logic error in the code. This could lead to remote code execution wit CVE-2026-568886.2In multiple locations, there is a possible permission bypass due to side channel information disclosure. This could lead to local escalation CVE-2026-568896.7In multiple locations, there is a possible permission bypass due to an integer overflow. This could lead to local escalation of privilege wi CVE-2026-56897.3A vulnerability was detected in Totolink A7100RU 7.4cu.2313_b20191024. The affected element is the function setNtpCfg of the file /cgi-bin/c CVE-2026-568926.2In ReadDataElement of common.c, there is a possible information disclosure due to an incorrect bounds check. This could lead to local inform CVE-2026-56907.3A flaw has been found in Totolink A7100RU 7.4cu.2313_b20191024. The impacted element is the function setRemoteCfg of the file /cgi-bin/cstec CVE-2026-569067.0In ep_free of eventpoll.c, there is a possible use-after-free due to a race condition. This could lead to local escalation of privilege with CVE-2026-569076.7In VPU, there is a possible shared memory overwrite due to improper input validation. This could lead to local escalation of privilege with CVE-2026-56917.3A vulnerability has been found in Totolink A7100RU 7.4cu.2313_b20191024. This affects the function setFirewallType of the file /cgi-bin/cste