CVE-2026-63230
A critical vulnerability in Koollab LMS lets anyone on the network read sensitive data from the database without authentication. The flaw is an error‑based SQL injection that can expose personal information, login credentials, and JWT tokens. It can be exploited simply by sending a crafted request to the SCORM report endpoint.
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
Koollab Learning Management System (LMS) – all versions that have the vulnerable SCORM report endpoint. The typical users are educational institutions and organizations that use Koollab LMS for course delivery.
Real-world impact
An attacker can retrieve personal data, usernames, passwords, and valid JWT tokens from the database. With that information, the attacker could impersonate legitimate users and take over their accounts.
Why this severity
The CVSS score of 9.1 reflects a network‑accessible attack that requires no user interaction, no privileges, and low complexity. The vulnerability gives full confidentiality and integrity compromise, but does not affect availability, leading to a high overall score.
What to do about it
No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.
No fix documented in sources