PT-2026-7166 · Unknown · Polarlearn

Jvr2022 · Published 2026-02-09 · Updated 2026-02-10 · CVE-2026-25885

Positive Technologies (AI Summary)

CVSS v4.0

10

Critical

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L

Name of the Vulnerable Software and Affected Versions PolarLearn versions prior to 0-PRERELEASE-16

Description PolarLearn is a free and open-source learning program. The group chat WebSocket at wss://polarlearn.nl/api/v1/ws can be used without authentication. An unauthenticated client can subscribe to any group chat by providing a group UUID and send messages to any group. The server accepts and stores these messages in the group’s chatContent.

Recommendations Update PolarLearn to version 0-PRERELEASE-16 or later.

Exploit

Fix

Missing Authentication

Improper Authorization

Weakness Enumeration

CWE-306

CWE-285

Related Identifiers

CVE-2026-25885

GHSA-GVJM-5PW7-6C8C

Affected Products

Polarlearn

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25885.json · Exploit
• https://github.com/polarnl/PolarLearn/commit/3ba588fda0d3f8e238483a20772719f27e52e79f · Patch
• https://github.com/polarnl/PolarLearn/security/advisories/GHSA-gvjm-5pw7-6c8c · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-25885 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-25885 · Security Note
• https://twitter.com/VulmonFeeds/status/2021122126791561559 · Twitter Post
• https://twitter.com/CVEnew/status/2020982062061134227 · Twitter Post
• https://t.me/CVEtracker/44232 · Telegram Post