PT-2026-7131 · Markus · Markus

Ibrah-M + 2 · Published 2026-02-09 · Updated 2026-02-09 · CVE-2026-24900

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions MarkUs versions prior to 2.9.1

Description MarkUs is a web application used for submitting and grading student assignments. A flaw exists where the select file id parameter in the ''courses/<:course id>/assignments/<:assignment id>/submissions/html content'' endpoint was not properly restricted to the user making the request. This allowed users to access submission file contents by ID without authorization. The vulnerable parameter is select file id.

Recommendations Upgrade to version 2.9.1 or later.

Exploit

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2026-24900

GHSA-56GH-8HMQ-7Q88

Affected Products

Markus

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/24xxx/CVE-2026-24900.json · Exploit
• https://github.com/MarkUsProject/Markus/commit/7daed9fd2d44932223798d997b55094a3bff104b · Patch
• https://github.com/MarkUsProject/Markus/security/advisories/GHSA-56gh-8hmq-7q88 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-24900 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-24900 · Security Note
• https://github.com/MarkUsProject/Markus/releases/tag/v2.9.1 · Note
• https://twitter.com/CVEnew/status/2020959703098962172 · Twitter Post