CVE-2026-63231

HighCVSS 8.1/10Last modified Oct 23, 2026

Description

A post-authentication SQL injection vulnerability in Koollab LMS allowed an authenticated attacker to use an error-based SQL oracle via the face-to-face runs update endpoint to read the entire application database and obtain valid JWT tokens for account takeover.

Metrics

CVSS 3.1 8.1/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-89

Affected software

VendorProductVersions
Three LearningKoollab LMS5.3.2

References

Timeline

Published
Jul 29, 2026
Last modified
Oct 23, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-632329.9A SQL injection and unsafe deserialisation vulnerability in Koollab LMS allowed an authenticated attacker to inject through the assessment rCVE-2026-632339.9A SQL injection and unsafe deserialisation vulnerability in Koollab LMS allowed an authenticated attacker to inject through the assessment oCVE-2026-632349.9A SQL injection and unsafe deserialisation vulnerability in Koollab LMS allowed an authenticated attacker to inject through the manual mark CVE-2026-632353.7An improper access control vulnerability in Koollab LMS allowed an unauthenticated attacker to forcibly terminate the session of any user giCVE-2026-632363.7An improper access control vulnerability in Koollab LMS allowed an unauthenticated attacker to read another user's name, internal identifierCVE-2026-632374.8A TOTP two-factor authentication bypass vulnerability in Koollab LMS allowed an attacker to supply a client-controlled seed to generate a maCVE-2026-632386.5An authentication bypass vulnerability in Koollab LMS allowed an unauthenticated attacker to take over any account, including administrator CVE-2026-632395.4A hard-coded AWS IAM credentials vulnerability in Koollab LMS allowed an attacker to access shared multi-tenant S3 buckets and SQS queues, eCVE-2026-63244.8A flaw was found in libsoup. A remote attacker could exploit an unsigned to signed conversion error in the `soup_body_input_stream_read_chunCVE-2026-632404.3An information disclosure vulnerability in Koollab LMS allowed an authenticated learner to obtain correct quiz answers from the course statuCVE-2026-632413.1An insecure direct object reference vulnerability in Koollab LMS allowed an authenticated user to query the course completion progress of anCVE-2026-632424.3A business logic vulnerability in Koollab LMS allowed an authenticated learner to set their lesson completion status to completed via the SC
CVE-2026-63231: High severity, CVSS 8.1 | Vulnix