Live › vulnerability › CVE-2026-111603
Go to dashboardPlayEdu through 2.3 has a missing authorization check in CourseController that skips the department visibility test. A logged-in student can enumerate sequential course and attachment IDs to read course structure and download attachment files from departments they should not see.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams that run PlayEdu 2.3 or earlier with department-restricted courses and student accounts from more than one department. Deployments without department restrictions, or where only trusted users hold accounts, are much less exposed. The sources do not say how common department-restricted setups are.
No product ranges from the sources yet.
2.3; the sources describe 2.3 and earlier as affectedCourseController for a department visibility check on the course details and attachment download endpointsEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
PlayEdu through 2.3 contains a missing authorization vulnerability in the CourseController that allows authenticated students to access department-restricted courses by omitting the department visibility check. Attackers can enumerate sequential course and attachment IDs via the course details and attachment download endpoints to obtain course structure and attachment files from other departments.
This page as .md · .json · in your agent: get_signal("CVE-2026-111603")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.