What’s Vulnerable › Products

Erudika scoold vulnerabilities

11 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 8 published in the last 12 months.

Check whether your Erudika scoold version is affected

Latest Erudika scoold vulnerabilities

• CVE-2026-55842 — Scoold: CORS wildcard origin with credentials enabled allows cross-origin authenticated API access from any domain (CVSS 5.4)
• CVE-2026-55840 — Scoold: Open Redirect in getBackToUrl() allows phishing via domain-prefix startsWith bypass (CVSS 5.4)
• CVE-2026-57183 — Scoold: Forged JWT Accepted as Admin API Token Allowing Unauthorized Access to Sensitive Configuration and Logs (CVSS 6.1)
• CVE-2026-54677 — Scoold: Authenticated user can post replies and comments to private-space questions without space membership (CVSS 6.5)
• CVE-2026-54676 — Scoold: GET /api/posts/{id}/answers leaks private-space replies when personal API tokens are enabled (CVSS 6.5)
• CVE-2026-42176 — Scoold: Persistent Admin Takeover by Overwriting the admins Configuration Setting via Forged JWT (missing `jti` validation) (CVSS 6.7)
• CVE-2026-39354 — Scoold has an Authenticated Arbitrary Question Overwrite via Client-Controlled postId in POST /questions/ask (CVSS 6.5)
• CVE-2026-34832 — Scoold: Cross-Account Feedback Deletion (IDOR) (CVSS 6.5)
• CVE-2024-50334 — Semicolon Path Injection on API /api;/config (CVSS 5.3)
• CVE-2022-1543 — Improper handling of Length parameter in erudika/scoold (CVSS 8.8)
• CVE-2021-46372 — (CVSS 5.4)