PT-2026-29878 · Scoold · Scoold

Qiaonpc · Published 2026-04-02 · Updated 2026-04-03 · CVE-2026-34832

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Scoold versions prior to 1.66.1

Description Scoold, a Q&A and knowledge sharing platform, has an authorization issue in feedback deletion. Any authenticated user with low privileges can delete feedback posts created by other users by submitting the post's ID to the API endpoint ''/feedback/{id}/delete''. The system verifies user authentication but does not confirm if the user has permission to delete the feedback item before proceeding with the deletion. The id variable in the API endpoint is used to identify the feedback post to be deleted.

Recommendations Update Scoold to version 1.66.1 or later.

Exploit

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2026-34832

Affected Products

Scoold

References · 5

• 🔥 https://github.com/Erudika/scoold/security/advisories/GHSA-g5fv-xw88-vw44 · Exploit
• https://github.com/Erudika/scoold/commit/5def88c25405cc60482292bcceb45dc024e899fe · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-34832 · Security Note
• https://github.com/Erudika/scoold/releases/tag/1.66.1 · Note
• https://twitter.com/CVEnew/status/2040128770850365636 · Twitter Post