Live › vulnerability › CVE-2026-120199
LearnHouse, an open-source learning platform, has a missing authorization check in its assignment API before version 1.1.1. An authenticated user can supply another user's ID to read that person's grades, submissions and instructor feedback.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-31 18:37 UTC. All times on this page are UTC.
Any LearnHouse deployment running a version before 1.1.1 where student accounts can reach the assignment API. Attackers need a valid account on that instance, so deployments with open self-registration carry more exposure than invite-only ones.
No product ranges from the sources yet.
1.1.1 or later is not affected.1.1.1 or later (per the NVD entry; the sources do not name a separate patch).Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
LearnHouse before 1.1.1 contains a missing authorization vulnerability in the assignment API that allows authenticated users to read other users' grades and submissions. Attackers can supply another user_id to the submissions grade endpoint or query submission read functions to view other students' work, grades and instructor feedback.
This page as .md · .json · in your agent: get_signal("CVE-2026-120199")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.