CVE-2026-63235

Published: Jul 29, 2026Modified: Jul 30, 2026Deferred

3.7

Vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

Exploitability: 2.2 / Impact: 1.4

Source: 5f57b9bf-260d-4433-bf07-b6a79e9bb7d4 (Secondary)

Description

An improper access control vulnerability in Koollab LMS allowed an unauthenticated attacker to forcibly terminate the session of any user given their email address via the login kickout endpoint, resulting in a denial of service.

Related CWEs

CWE-284

Improper Access Control

The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

References (1)

https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2026-094/

Source: 5f57b9bf-260d-4433-bf07-b6a79e9bb7d4

Timeline

No history available yet.