{"id":"CVE-2026-111603","kind":"vulnerability","aliases":["CVE-2026-111603"],"related":[],"title":"PlayEdu: authenticated students can read other departments' courses and attachments","description":"PlayEdu through 2.3 contains a missing authorization vulnerability in the CourseController that allows authenticated students to access department-restricted courses by omitting the department visibility check. Attackers can enumerate sequential course and attachment IDs via the course details and attachment download endpoints to obtain course structure and attachment files from other departments.","summary":"PlayEdu through 2.3 has a missing authorization check in CourseController that skips the department visibility test. A logged-in student can enumerate sequential course and attachment IDs to read course structure and download attachment files from departments they should not see.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["elearning","package","playedu","self-hosted"],"not_affected_if":["no-department-restrictions","single-department-deployment"],"how_to_check":"- Check the installed PlayEdu version against `2.3`; the sources describe 2.3 and earlier as affected\n- Review `CourseController` for a department visibility check on the course details and attachment download endpoints\n- unknown whether the sources name a specific file path or setting","fix":"- unknown: the sources do not name a fixed version or patch\n- Until a fix is available, restrict student accounts or limit access to attachment download endpoints","status":"open","published_at":"2026-10-16T18:17:39+00:00","first_seen_at":"2026-10-23T21:57:13+00:00","triaged_at":"2026-10-25T04:27:16+00:00","updated_at":"2026-10-25T04:27:16+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T04:27:16Z","model":"claude-haiku-5-5","output":{"fix":"- unknown: the sources do not name a fixed version or patch\n- Until a fix is available, restrict student accounts or limit access to attachment download endpoints","reach":"internet","title":"PlayEdu: authenticated students can read other departments' courses and attachments","impact":"medium","summary":"PlayEdu through 2.3 has a missing authorization check in CourseController that skips the department visibility test. A logged-in student can enumerate sequential course and attachment IDs to read course structure and download attachment files from departments they should not see.","category":"package","nicknames":[],"who_cares":["playedu","self-hosted","elearning"],"confidence":0.6,"needs_auth":"yes","worst_case":"Students read other departments' course files and structure through sequential IDs","analyst_note":"Confirm the fixed version and whether department restrictions are on by default; the NVD entry lists CVSS 5.3 but the sources give no patch.","how_to_check":"- Check the installed PlayEdu version against `2.3`; the sources describe 2.3 and earlier as affected\n- Review `CourseController` for a department visibility check on the course details and attachment download endpoints\n- unknown whether the sources name a specific file path or setting","needs_analyst":true,"not_affected_if":["no-department-restrictions","single-department-deployment"],"who_is_affected":"Teams that run PlayEdu 2.3 or earlier with department-restricted courses and student accounts from more than one department. Deployments without department restrictions, or where only trusted users hold accounts, are much less exposed. The sources do not say how common department-restricted setups are.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000624,"input_tokens":3328,"output_tokens":582,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-111603':13A,16A '-2026':12A,15A '2.3':25B,67C 'access':81C 'allow':77C 'attach':10A,49B,57B,98C,105C,113C 'attack':92C 'authent':2A,78C 'author':29B,71C 'check':30B,91C 'contain':68C 'cours':8A,47B,53B,85C,96C,102C,110C 'coursecontrol':32B,75C 'cve':11A,14A 'depart':7A,36B,60B,83C,89C,117C 'department-restrict':82C 'detail':103C 'download':56B,106C 'elearn':17B 'endpoint':107C 'enumer':45B,94C 'file':58B,114C 'host':22B 'id':50B,99C 'log':41B 'logged-in':40B 'miss':28B,70C 'obtain':109C 'omit':87C 'packag':18B 'playedu':1A,19B,23B,65C 'read':5A,52B 'restrict':84C 'see':64B 'self':21B 'self-host':20B 'sequenti':46B,95C 'skip':34B 'structur':54B,111C 'student':3A,43B,79C 'test':38B 'via':100C 'visibl':37B,90C 'vulner':72C","nicknames":[],"mitigations":[],"who_affected":"Teams that run PlayEdu 2.3 or earlier with department-restricted courses and student accounts from more than one department. Deployments without department restrictions, or where only trusted users hold accounts, are much less exposed. The sources do not say how common department-restricted setups are.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-16T18:17:39+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111603","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111603","severity":null,"published_at":"2026-10-16T18:17:39+00:00","modified_at":"2026-10-23T19:17:42+00:00","first_seen_at":"2026-10-23T21:57:13+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}