PT-2026-7166 · Unknown · Polarlearn

Jvr2022 · Publicado 2026-02-09 · Atualizado 2026-02-10 · CVE-2026-25885

Positive Technologies (AI Summary)

CVSS v4.0

10

Crítica

Vetor base

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L

Name of the Vulnerable Software and Affected Versions PolarLearn versions prior to 0-PRERELEASE-16

Description PolarLearn is a free and open-source learning program. The group chat WebSocket at wss://polarlearn.nl/api/v1/ws can be used without authentication. An unauthenticated client can subscribe to any group chat by providing a group UUID and send messages to any group. The server accepts and stores these messages in the group’s chatContent.

Recommendations Update PolarLearn to version 0-PRERELEASE-16 or later.

Exploit

Correção

Missing Authentication

Improper Authorization

Enumeração de Fraquezas

CWE-306

CWE-285

Identificadores relacionados

CVE-2026-25885

GHSA-GVJM-5PW7-6C8C

Produtos afetados

Polarlearn

Referências · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25885.json · Exploit
• https://github.com/polarnl/PolarLearn/commit/3ba588fda0d3f8e238483a20772719f27e52e79f · Correção
• https://github.com/polarnl/PolarLearn/security/advisories/GHSA-gvjm-5pw7-6c8c · Aviso do Fabricante
• https://twitter.com/VulmonFeeds/status/2021122126791561559 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2026-25885 · Aviso do Fabricante
• https://twitter.com/CVEnew/status/2020982062061134227 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2026-25885 · Nota de Segurança
• https://t.me/CVEtracker/44232 · Publicação no Telegram