CVE-2026-63239

MediumCVSS 5.4/10Last modified Oct 23, 2026

Description

A hard-coded AWS IAM credentials vulnerability in Koollab LMS allowed an attacker to access shared multi-tenant S3 buckets and SQS queues, exposing sensitive data and enabling malicious content injection, job manipulation, or email interception.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-798

Affected software

No affected versions have been published.

Timeline

Published: Jul 29, 2026
Last modified: Oct 23, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-63244.8A flaw was found in libsoup. A remote attacker could exploit an unsigned to signed conversion error in the `soup_body_input_stream_read_chun CVE-2026-632404.3An information disclosure vulnerability in Koollab LMS allowed an authenticated learner to obtain correct quiz answers from the course statu CVE-2026-632413.1An insecure direct object reference vulnerability in Koollab LMS allowed an authenticated user to query the course completion progress of an CVE-2026-632424.3A business logic vulnerability in Koollab LMS allowed an authenticated learner to set their lesson completion status to completed via the SC CVE-2026-632434.3An authentication vulnerability in the Bluetooth Low Energy (BLE) implementation of Creative Sound Blaster Katana could allow an attacker wi CVE-2026-632449.8An authentication bypass vulnerability in WizLearn Technologies' Learning Management System (LMS) could allow an unauthenticated remote atta CVE-2026-632486.5In Eclipse Milo versions 0.6.0 through 1.1.4, OPC UA server diagnostics nodes do not enforce access authorization. An anonymous client can e CVE-2026-63257.5Out-of-bounds write in SetSuitesHashSigAlgo when processing an oversized signature algorithms list, allowing a write past the bounds of the CVE-2026-632527.5In Eclipse Milo versions 0.6.0 through 1.1.4, UASC server transport handlers fail to release retained partial message chunks when a channel CVE-2026-632594.3Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to information disclosure via user-supplied identifiers that r CVE-2026-632606.5Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated a CVE-2026-632616.5Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). A low-privileged a