CVE-2026-109564 — LearnHouse before 1.4.0 Missing Authorization via Playground Duplicate Endpoint
LearnHouse before 1.4.0 contains a missing authorization vulnerability in POST /api/v1/playgrounds/{uuid}/duplicate that skips the read-access and draft checks enforced by get_p…
Published: 2026-10-12 · CVSS: 2.3 · CVSS 4.0
LearnHouse before 1.4.0 contains a missing authorization vulnerability in POST /api/v1/playgrounds/{uuid}/duplicate that skips the read-access and draft checks enforced by get_playground. Authenticated users with playground creation rights, such as Instructors, who know a RESTRICTED or unpublished playground UUID can copy its html_content and republish it publicly.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7