CVE-2026-57183

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-57183
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-57183.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-57183
Aliases
  • GHSA-6q9q-cqq5-hvmq
Published
2026-10-15T18:32:47Z
Modified
2026-10-30T07:21:42Z
Severity
  • 6.1 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N CVSS Calculator
Summary
Scoold: Forged JWT Accepted as Admin API Token Allowing Unauthorized Access to Sensitive Configuration and Logs
Details

Scoold is a Q&A and a knowledge sharing platform for teams. Prior to 1.69.1, checkApiAuth() in src/main/java/com/erudika/scoold/utils/ScooldUtils.java accepts a JWT signed with app_secret_key or para_secret_key for /api/config and /api/stats without requiring a registered API-key jti, and maps the request to the hardcoded administrative API_USER. The special endpoint checks run even when scoold.api_enabled is false. An attacker who obtains either signing secret can forge a token that reads sensitive configuration and server logs and reaches privileged configuration functionality, while an ordinary login-session token is not sufficient. This issue is fixed in version 1.69.1.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-287"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/57xxx/CVE-2026-57183.json"
}
References

Affected packages

Git / github.com/erudika/scoold

Affected ranges

Type
GIT
Repo
https://github.com/erudika/scoold
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
f6d2be9995df28c0776f477f124e827fc537058e
Fixed
de018c17a60c352f318109a762a377c325a5fd97
Fixed
e527d4da1ac04b6a35bd86e560c279f0160c5c02
Database specific
Show details 
{
    "extracted_events": [
        {
            "range": [
                {
                    "introduced": "0"
                },
                {
                    "fixed": "1.69.1"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StringRangeExpression"
        },
        {
            "range": [
                {
                    "fixed": "de018c17a60c352f318109a762a377c325a5fd97"
                }
            ],
            "source": "REFERENCES_COMMIT"
        },
        {
            "range": [
                {
                    "fixed": "e527d4da1ac04b6a35bd86e560c279f0160c5c02"
                }
            ],
            "source": "REFERENCES_COMMIT"
        },
        {
            "original_tag": "1.69.1",
            "range": [
                {
                    "fixed": "f6d2be9995df28c0776f477f124e827fc537058e"
                }
            ],
            "source": "REFERENCES_TAG"
        }
    ]
}

Affected versions

1.*
1.24.1
1.24.10
1.24.11
1.24.2
1.24.3
1.24.4
1.24.5
1.24.6
1.24.7
1.24.8
1.24.9
1.25.0
1.25.1
1.25.2
1.25.3
1.25.4
1.25.5
1.26.0
1.26.1
1.28.0
1.28.1
1.28.10
1.28.2
1.28.3
1.28.4
1.28.5
1.28.6
1.28.7
1.28.8
1.28.9
1.29.0
1.29.1
1.29.2
1.29.3
1.29.4
1.30.0
1.30.1
1.30.2
1.30.3
1.30.4
1.30.5
1.31.0
1.31.1
1.31.2
1.31.3
1.31.4
1.32.0
1.32.1
1.33.0
1.33.1
1.34.0
1.35.0
1.35.1
1.35.2
1.35.3
1.36.0
1.36.1
1.36.2
1.37.0
1.37.1
1.38.0
1.39.0
1.39.1
1.39.2
1.39.3
1.39.4
1.40.0
1.40.1
1.40.2
1.40.3
1.40.4
1.40.5
1.41.0
1.41.1
1.41.2
1.42.1
1.43.0
1.43.1
1.43.2
1.43.3
1.44.0
1.45.0
1.46.0
1.46.1
1.46.2
1.46.3
1.48.0
1.48.1
1.48.2
1.49.0
1.49.1
1.49.2
1.49.3
1.49.4
1.49.5
1.49.6
1.49.7
1.50.0
1.50.1
1.50.2
1.50.3
1.50.4
1.50.5
1.51.0
1.51.1
1.51.2
1.51.3
1.52.0
1.52.1
1.52.2
1.52.3
1.53.0
1.54.0
1.54.1
1.55.0
1.56.0
1.56.1
1.57.0
1.57.1
1.57.2
1.57.3
1.57.4
1.57.5
1.58.0
1.58.1
1.59.0
1.60.0
1.61.0
1.62.0
1.63.0
1.64.0
1.64.2
1.64.3
1.64.4
1.64.5
1.65.0
1.66.0
1.66.1
1.66.2
1.67.0
1.67.1
1.68.0
1.68.1
1.68.2
1.69.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-57183.json"
vanir_signatures 
[
    {
        "deprecated": false,
        "digest": {
            "function_hash": "196614759031803783416934244558153780068",
            "length": 891
        },
        "id": "CVE-2026-57183-0840f0b3",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/erudika/scoold/commit/de018c17a60c352f318109a762a377c325a5fd97",
        "target": {
            "file": "src/main/java/com/erudika/scoold/utils/ScooldRequestInterceptor.java",
            "function": "preHandle"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "23122174929998580870688336256452586791",
            "length": 652
        },
        "id": "CVE-2026-57183-4a95c28e",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/erudika/scoold/commit/e527d4da1ac04b6a35bd86e560c279f0160c5c02",
        "target": {
            "file": "src/main/java/com/erudika/scoold/utils/ScooldUtils.java",
            "function": "isApiKeyRevoked"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "270039472689745270409643529896173495804",
            "length": 480
        },
        "id": "CVE-2026-57183-7cdd5568",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/erudika/scoold/commit/e527d4da1ac04b6a35bd86e560c279f0160c5c02",
        "target": {
            "file": "src/main/java/com/erudika/scoold/utils/ScooldUtils.java",
            "function": "checkApiAuth"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "164661062476816053361854466216248114116",
                "267549660188485278557888491127169813713",
                "203915375514604265188901905548889057876",
                "7018637731981620984952300911099018611",
                "322536255209929387155491770256897306709",
                "237486090529131912887176379349933421007",
                "88385792564810669133765177004104655331",
                "331947463851636020034607040555368949148"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-57183-ace70da1",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/erudika/scoold/commit/de018c17a60c352f318109a762a377c325a5fd97",
        "target": {
            "file": "src/main/java/com/erudika/scoold/utils/ScooldUtils.java"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "111334029533434901417262324596260011590",
            "length": 605
        },
        "id": "CVE-2026-57183-d3667d08",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/erudika/scoold/commit/de018c17a60c352f318109a762a377c325a5fd97",
        "target": {
            "file": "src/main/java/com/erudika/scoold/utils/ScooldUtils.java",
            "function": "checkApiAuth"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "19191062004323910607578547326218363881",
                "301604431887080716295108919013107013685",
                "67882537832058347905426942151551511828",
                "141118163328650592121781052539727697214",
                "210307423564813337201273811371362573822",
                "75088271205222117476768128912518109025",
                "201414455170975927066649608016460749324"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-57183-dcac86e1",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/erudika/scoold/commit/de018c17a60c352f318109a762a377c325a5fd97",
        "target": {
            "file": "src/main/java/com/erudika/scoold/utils/ScooldRequestInterceptor.java"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "74505953417714663574138658397632391528",
                "37472584643181913141486225708058580253",
                "139863233214852867344550485534034989395",
                "171093532507264733653704895342308504426",
                "97733300637815560254715476093408234942",
                "62294568475713879690957675507826773580",
                "221727477954254326307359877901547041292",
                "169669842176690653153130784196709054888",
                "240963828462109703540150987607501351979",
                "254336464329483247212592128178755411893",
                "130531375535368660818266806091300387733",
                "150701295176785003060232894230741714234",
                "128925687439617325249206936673826880594",
                "302264402734885339301330709785552509952",
                "138895522464856714836209500717660905678",
                "225457510778727063313213268285163578558",
                "57752908962137451894326156215229685245",
                "129985312839456675207672127322775662603",
                "236417330792771814000784318475465502893",
                "184625777303294149274417637352801275273",
                "115542415034382463596198836863084910700",
                "191161085126753643457434185946946723500",
                "120851335051929764619895616805235409417",
                "139954806690192885934413140068574522238",
                "68051481514918927923718139516105124902",
                "153778340068220560959386448588956974049",
                "59142255930196676536081957801961666860"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-57183-f7e829e0",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/erudika/scoold/commit/e527d4da1ac04b6a35bd86e560c279f0160c5c02",
        "target": {
            "file": "src/main/java/com/erudika/scoold/utils/ScooldUtils.java"
        }
    }
]
vanir_signatures_modified 
"2026-10-30T07:21:42Z"