---
id: "CVE-2026-111603"
kind: "vulnerability"
aliases: ["CVE-2026-111603"]
title: "PlayEdu: authenticated students can read other departments' courses and attachments"
severity: "medium"
cvss: 5.3
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["elearning", "package", "playedu", "self-hosted"]
not_affected_if: ["no-department-restrictions", "single-department-deployment"]
published_at: "2026-10-16T18:17:39+00:00"
first_seen_at: "2026-10-23T21:57:13+00:00"
updated_at: "2026-10-25T04:27:16+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111603", "first_seen_at": "2026-10-23T21:57:13+00:00"}]
---

# PlayEdu: authenticated students can read other departments' courses and attachments

PlayEdu through 2.3 has a missing authorization check in CourseController that skips the department visibility test. A logged-in student can enumerate sequential course and attachment IDs to read course structure and download attachment files from departments they should not see.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed PlayEdu version against `2.3`; the sources describe 2.3 and earlier as affected
- Review `CourseController` for a department visibility check on the course details and attachment download endpoints
- unknown whether the sources name a specific file path or setting

## Fix

- unknown: the sources do not name a fixed version or patch
- Until a fix is available, restrict student accounts or limit access to attachment download endpoints

## Timeline

- 2026-10-23T21:57:13+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-111603

## From the sources

PlayEdu through 2.3 contains a missing authorization vulnerability in the CourseController that allows authenticated students to access department-restricted courses by omitting the department visibility check. Attackers can enumerate sequential course and attachment IDs via the course details and attachment download endpoints to obtain course structure and attachment files from other departments.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_