PT-2026-7131 · Markus · Markus

Ibrah-M + 2 · Publicado 2026-02-09 · Atualizado 2026-02-09 · CVE-2026-24900

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions MarkUs versions prior to 2.9.1

Description MarkUs is a web application used for submitting and grading student assignments. A flaw exists where the select file id parameter in the ''courses/<:course id>/assignments/<:assignment id>/submissions/html content'' endpoint was not properly restricted to the user making the request. This allowed users to access submission file contents by ID without authorization. The vulnerable parameter is select file id.

Recommendations Upgrade to version 2.9.1 or later.

Exploit

Correção

IDOR

Enumeração de Fraquezas

CWE-639

Identificadores relacionados

CVE-2026-24900

GHSA-56GH-8HMQ-7Q88

Produtos afetados

Markus

Referências · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/24xxx/CVE-2026-24900.json · Exploit
• https://github.com/MarkUsProject/Markus/commit/7daed9fd2d44932223798d997b55094a3bff104b · Correção
• https://github.com/MarkUsProject/Markus/security/advisories/GHSA-56gh-8hmq-7q88 · Aviso do Fabricante
• https://github.com/MarkUsProject/Markus/releases/tag/v2.9.1 · Nota
• https://twitter.com/CVEnew/status/2020959703098962172 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2026-24900 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2026-24900 · Nota de Segurança