CVE-2026-113353

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-113353
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-113353.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-113353
Published
2026-10-20T10:41:38Z
Modified
2026-10-21T02:55:52Z
Severity
  • 5.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N CVSS Calculator
Summary
LearnPress before 4.4.10 Missing Authorization via Legacy Editor AJAX Handlers
Details

LearnPress before 4.4.10 contains a missing authorization vulnerability in the admin_course_editor, admin_quiz_editor and admin_question_editor lp-ajax actions, allowing instructors to modify other instructors' content. Authenticated instructors can reuse their own generic editor nonce with another object's id parameter to alter courses, change quiz answers, and trash questions.

Database specific 
{
    "cna_assigner":  "VulnCheck",
    "cwe_ids":  [
        "CWE-639"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/113xxx/CVE-2026-113353.json",
    "unresolved_ranges":  [
        {
            "extracted_events":  [
                {
                    "range":  [
                        {
                            "fixed":  "4.4.10"
                        }
                    ],
                    "source":  "AFFECTED_FIELD",
                    "strategy":  "StandardRange"
                }
            ]
        },
        {
            "extracted_events":  [
                {
                    "range":  [
                        {
                            "fixed":  "4.4.10"
                        }
                    ],
                    "source":  "CPE_FIELD",
                    "strategy":  "CPEApplicability"
                }
            ]
        },
        {
            "extracted_events":  [
                {
                    "range":  [
                        {
                            "fixed":  "4.4.10"
                        }
                    ],
                    "source":  "DESCRIPTION"
                }
            ]
        }
    ]
}
References

Affected packages

Git / github.com/learnpress/learnpress

Affected ranges

Type
GIT
Repo
https://github.com/learnpress/learnpress
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
77087dcdc0e974e8d0844453b4071189fc2c70d2
Database specific
Show details 
{
    "extracted_events":  [
        {
            "range":  [
                {
                    "fixed":  "77087dcdc0e974e8d0844453b4071189fc2c70d2"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        }
    ]
}

Affected versions

2.*
2.0.0-beta.1
2.0.6
2.0.9
2.1.0
2.1.3
2.1.4
2.1.5.2
2.1.5.3
2.1.6
3.*
3.2.1
3.2.2
v1.*
v1.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-113353.json"