CVE-2026-34832

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-34832

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-34832.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-34832

Aliases

GHSA-g5fv-xw88-vw44

Published

2026-04-02T19:08:03Z

Modified

2026-10-21T02:56:56Z

Severity

6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N CVSS Calculator

Summary

Scoold: Cross-Account Feedback Deletion (IDOR)

Details

Scoold is a Q&A and a knowledge sharing platform for teams. Prior to version 1.66.1, Scoold contains an authenticated authorization flaw in feedback deletion that allows any logged-in, low-privilege user to delete another user's feedback post by submitting its ID to POST /feedback/{id}/delete. The handler enforces authentication but does not enforce object ownership (or moderator/admin authorization) before deletion. In verification, a second non-privileged account successfully deleted a victim account's feedback item, and the item immediately disappeared from the feedback listing/detail views. This issue has been patched in version 1.66.1.

Database specific

{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-639"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/34xxx/CVE-2026-34832.json"
}

References

Affected packages

Git / github.com/erudika/scoold

Affected ranges

Type

GIT

Repo

https://github.com/erudika/scoold

Events

Introduced

Fixed

61ae65b4468a0c74844689842311336b2a64046c

Fixed

5def88c25405cc60482292bcceb45dc024e899fe

Database specific

Show details

{
    "extracted_events":  [
        {
            "cpe":  "cpe:2.3:a:erudika:scoold:*:*:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "0"
                },
                {
                    "fixed":  "1.66.1"
                }
            ],
            "source":  "CPE_RANGE"
        },
        {
            "range":  [
                {
                    "fixed":  "5def88c25405cc60482292bcceb45dc024e899fe"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        },
        {
            "original_tag":  "1.66.1",
            "range":  [
                {
                    "fixed":  "61ae65b4468a0c74844689842311336b2a64046c"
                }
            ],
            "source":  "REFERENCES_TAG"
        }
    ]
}

Affected versions

1.*

1.24.1

1.24.10

1.24.11

1.24.2

1.24.3

1.24.4

1.24.5

1.24.6

1.24.7

1.24.8

1.24.9

1.25.0

1.25.1

1.25.2

1.25.3

1.25.4

1.25.5

1.26.0

1.26.1

1.28.0

1.28.1

1.28.10

1.28.2

1.28.3

1.28.4

1.28.5

1.28.6

1.28.7

1.28.8

1.28.9

1.29.0

1.29.1

1.29.2

1.29.3

1.29.4

1.30.0

1.30.1

1.30.2

1.30.3

1.30.4

1.30.5

1.31.0

1.31.1

1.31.2

1.31.3

1.31.4

1.32.0

1.32.1

1.33.0

1.33.1

1.34.0

1.35.0

1.35.1

1.35.2

1.35.3

1.36.0

1.36.1

1.36.2

1.37.0

1.37.1

1.38.0

1.39.0

1.39.1

1.39.2

1.39.3

1.39.4

1.40.0

1.40.1

1.40.2

1.40.3

1.40.4

1.40.5

1.41.0

1.41.1

1.41.2

1.42.1

1.43.0

1.43.1

1.43.2

1.43.3

1.44.0

1.45.0

1.46.0

1.46.1

1.46.2

1.46.3

1.48.0

1.48.1

1.48.2

1.49.0

1.49.1

1.49.2

1.49.3

1.49.4

1.49.5

1.49.6

1.49.7

1.50.0

1.50.1

1.50.2

1.50.3

1.50.4

1.50.5

1.51.0

1.51.1

1.51.2

1.51.3

1.52.0

1.52.1

1.52.2

1.52.3

1.53.0

1.54.0

1.54.1

1.55.0

1.56.0

1.56.1

1.57.0

1.57.1

1.57.2

1.57.3

1.57.4

1.57.5

1.58.0

1.58.1

1.59.0

1.60.0

1.61.0

1.62.0

1.63.0

1.64.0

1.64.2

1.64.3

1.64.4

1.64.5

1.65.0

1.66.0

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-34832.json"