CVE-2026-24900

Published: Feb 9, 2026Modified: Jun 17, 2026

6.5

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Exploitability: 2.8 / Impact: 3.6

Source: security-advisories@github.com (Secondary)

Description

MarkUs is a web application for the submission and grading of student assignments. Prior to 2.9.1, the courses/<:course_id>/assignments/<:assignment_id>/submissions/html_content accepted a select_file_id parameter to serve SubmissionFile objects containing a record of files submitted by students. This parameter was not correctly scoped to the requesting user, allowing users access arbitrary submission file contents by id. This vulnerability is fixed in 2.9.1.

Affected (1)

Products: Markusproject: Markus

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Markusproject Markus	Before 2.9.1

Related CWEs

Authorization Bypass Through User-Controlled Key

The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

References (3)

https://github.com/MarkUsProject/Markus/commit/7daed9fd2d44932223798d997b55094a3bff104b

Source: security-advisories@github.com

Patch

https://github.com/MarkUsProject/Markus/releases/tag/v2.9.1

Source: security-advisories@github.com

ProductRelease Notes

https://github.com/MarkUsProject/Markus/security/advisories/GHSA-56gh-8hmq-7q88

Source: security-advisories@github.com

Vendor Advisory

Timeline

No history available yet.