CVE Feed

    Dashboard / CVE / CVE-2026-57183

    CVE-2026-57183

    Scoold is a Q&A and a knowledge sharing platform for teams. Prior to 1.69.1, checkApiAuth() in src/main/java/com/erudika/scoold/utils/ScooldUtils.java accepts a JWT signed with app_secret_key or para_secret_key for /api/config and /api/stats without requiring a registered API-key jti, and maps the request to the hardcoded administrative API_USER. The special endpoint checks run even when scoold.api_enabled is false. An attacker who obtains either signing secret can forge a token that reads sensitive configuration and server logs and reaches privileged configuration functionality, while an ordinary login-session token is not sufficient. This issue is fixed in version 1.69.1.

    Published:Oct 15, 2026
    Last Modified:Oct 28, 2026
    EPS:Oct 15, 2026
    EPSS Score:0.00233
    CVSS Score:6.1

    Affected Products

    Vendor
    Erudika
    Product
    Scoold

    Exploits

    No exploit reference

    Common Weakness Enumeration

    CWE-287 Improper Authentication

    Related CVEs

    CVE-2026-55840 (CVSS 5.4) — Scoold is a Q&A and a knowledge sharing platform for teams. Prior to 1.69.1, the getBackToUrl() method in src/…
    CVE-2026-55842 (CVSS 5.4) — Scoold is a Q&A and a knowledge sharing platform for teams. Prior to 1.69.1, the apiCorsConfiguration() method…
    CVE-2026-54676 (CVSS 6.5) — Scoold is a Q&A and a knowledge sharing platform for teams. Prior to 1.69.0, users with personal API tokens ca…
    CVE-2026-54677 (CVSS 6.5) — Scoold is a Q&A and a knowledge sharing platform for teams. Prior to 1.69.0, authenticated users who are not m…
    CVE-2026-42176 (CVSS 6.7) — Scoold is a Q&A and a knowledge sharing platform for teams. Prior to version 1.67.0, Scoold allows the admins …
    CVE-2026-39354 (CVSS 6.5) — Scoold is a Q&A and a knowledge sharing platform for teams. Prior to 1.66.2, an authenticated authorization fl…
    CVE-2026-34832 (CVSS 6.5) — Scoold is a Q&A and a knowledge sharing platform for teams. Prior to version 1.66.1, Scoold contains an authen…
    CVE-2024-50334 (CVSS 8.7) — Scoold is a Q&A and a knowledge sharing platform for teams. A semicolon path injection vulnerability was found…
    CVE-2022-1543 (CVSS 8.8) — Improper handling of Length parameter in GitHub repository erudika/scoold prior to 1.49.4. When the text size …
    CVE-2021-46372 (CVSS 5.4) — Scoold 1.47.2 is a Q&A/knowledge base platform written in Java. When writing a Q&A, the markdown editor is vul…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High