CVE-2026-55842

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-55842

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-55842.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-55842

Aliases

GHSA-q684-4jqv-c63c

Published

2026-10-15T18:30:57Z

Modified

2026-10-28T10:52:17Z

Severity

5.4 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N CVSS Calculator

Summary

Scoold: CORS wildcard origin with credentials enabled allows cross-origin authenticated API access from any domain

Details

Scoold is a Q&A and a knowledge sharing platform for teams. Prior to 1.69.1, the apiCorsConfiguration() method in src/main/java/com/erudika/scoold/ScooldServer.java combines addAllowedOriginPattern("*") with setAllowCredentials(true), causing Spring to reflect any requesting origin while allowing cookies or session tokens. A malicious website visited by a logged-in Scoold user can therefore issue authenticated API requests, read user data, questions, and configuration, and trigger state-changing operations on the user's behalf. This issue is fixed in version 1.69.1.

Database specific

{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-346",
        "CWE-942"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/55xxx/CVE-2026-55842.json"
}

References

Affected packages

Git / github.com/erudika/scoold

Affected ranges

Type

GIT

Repo

https://github.com/erudika/scoold

Events

Introduced

Fixed

f6d2be9995df28c0776f477f124e827fc537058e

Fixed

6412441f656984c07af147b6ba2f2fc7906b2c5c

Database specific

Show details

{
    "extracted_events": [
        {
            "range": [
                {
                    "introduced": "0"
                },
                {
                    "fixed": "1.69.1"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StringRangeExpression"
        },
        {
            "range": [
                {
                    "fixed": "6412441f656984c07af147b6ba2f2fc7906b2c5c"
                }
            ],
            "source": "REFERENCES_COMMIT"
        },
        {
            "original_tag": "1.69.1",
            "range": [
                {
                    "fixed": "f6d2be9995df28c0776f477f124e827fc537058e"
                }
            ],
            "source": "REFERENCES_TAG"
        }
    ]
}

Affected versions

1.*

1.24.1

1.24.10

1.24.11

1.24.2

1.24.3

1.24.4

1.24.5

1.24.6

1.24.7

1.24.8

1.24.9

1.25.0

1.25.1

1.25.2

1.25.3

1.25.4

1.25.5

1.26.0

1.26.1

1.28.0

1.28.1

1.28.10

1.28.2

1.28.3

1.28.4

1.28.5

1.28.6

1.28.7

1.28.8

1.28.9

1.29.0

1.29.1

1.29.2

1.29.3

1.29.4

1.30.0

1.30.1

1.30.2

1.30.3

1.30.4

1.30.5

1.31.0

1.31.1

1.31.2

1.31.3

1.31.4

1.32.0

1.32.1

1.33.0

1.33.1

1.34.0

1.35.0

1.35.1

1.35.2

1.35.3

1.36.0

1.36.1

1.36.2

1.37.0

1.37.1

1.38.0

1.39.0

1.39.1

1.39.2

1.39.3

1.39.4

1.40.0

1.40.1

1.40.2

1.40.3

1.40.4

1.40.5

1.41.0

1.41.1

1.41.2

1.42.1

1.43.0

1.43.1

1.43.2

1.43.3

1.44.0

1.45.0

1.46.0

1.46.1

1.46.2

1.46.3

1.48.0

1.48.1

1.48.2

1.49.0

1.49.1

1.49.2

1.49.3

1.49.4

1.49.5

1.49.6

1.49.7

1.50.0

1.50.1

1.50.2

1.50.3

1.50.4

1.50.5

1.51.0

1.51.1

1.51.2

1.51.3

1.52.0

1.52.1

1.52.2

1.52.3

1.53.0

1.54.0

1.54.1

1.55.0

1.56.0

1.56.1

1.57.0

1.57.1

1.57.2

1.57.3

1.57.4

1.57.5

1.58.0

1.58.1

1.59.0

1.60.0

1.61.0

1.62.0

1.63.0

1.64.0

1.64.2

1.64.3

1.64.4

1.64.5

1.65.0

1.66.0

1.66.1

1.66.2

1.67.0

1.67.1

1.68.0

1.68.1

1.68.2

1.69.0

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-55842.json"

vanir_signatures

[
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "172034990199097459864403738688388389776",
                "21263605405762280013873599310292608387",
                "149573811775756420766550269712948091439",
                "283207345916474518982559716330718514008"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-55842-1bfcec17",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/erudika/scoold/commit/6412441f656984c07af147b6ba2f2fc7906b2c5c",
        "target": {
            "file": "src/main/java/com/erudika/scoold/ScooldServer.java"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "313214038589104476391721922372725831326",
                "37898728479269746079032642176354881496",
                "15043947790127477068680686976423672944"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-55842-2cd755cd",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/erudika/scoold/commit/6412441f656984c07af147b6ba2f2fc7906b2c5c",
        "target": {
            "file": "src/main/java/com/erudika/scoold/ScooldConfig.java"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "156880324113289468722941403412803748946",
            "length": 276
        },
        "id": "CVE-2026-55842-74b2daa6",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/erudika/scoold/commit/6412441f656984c07af147b6ba2f2fc7906b2c5c",
        "target": {
            "file": "src/main/java/com/erudika/scoold/ScooldServer.java",
            "function": "apiCorsConfiguration"
        }
    }
]

vanir_signatures_modified

"2026-10-28T10:52:17Z"