CVE-2026-109564 in LearnHouse
Summary
by MITRE • 10/13/2026
LearnHouse before 1.4.0 contains a missing authorization vulnerability in POST /api/v1/playgrounds/{uuid}/duplicate that skips the read-access and draft checks enforced by get_playground. Authenticated users with playground creation rights, such as Instructors, who know a RESTRICTED or unpublished playground UUID can copy its html_content and republish it publicly.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/13/2026
The vulnerability identified in LearnHouse versions prior to 1.4.0 represents a critical failure in access control mechanisms within the application's API layer. Specifically, this flaw resides in the endpoint responsible for duplicating educational playgrounds, accessed via the POST method at /api/v1/playgrounds/{uuid}/duplicate. The core technical issue is that this specific operation bypasses the standard authorization checks implemented by the underlying get_playground function. In a properly secured system, any retrieval or manipulation of resource data should first verify whether the requesting user has appropriate permissions for that specific instance. However, in this scenario, the duplication logic operates independently of these safeguards, allowing actions to proceed without validating if the source playground is restricted, unpublished, or otherwise protected from public view.
This architectural oversight creates a significant security gap where authenticated users with general playground creation privileges can exploit their access rights to exfiltrate and republish content they are not authorized to see. The vulnerability specifically targets RESTRICTED or unpublished playgrounds, which typically contain sensitive educational materials, proprietary code examples, or internal training data intended for limited audiences such as specific student groups or instructors. By knowing the unique identifier (UUID) of a target playground, an attacker can invoke the duplicate endpoint to copy its html_content field. This content is then republished under a new UUID that is publicly accessible, effectively leaking confidential information to any user on the internet who might discover or guess the new public URL.
From an operational impact perspective, this vulnerability leads directly to unauthorized data disclosure and potential intellectual property theft. For educational institutions using LearnHouse, playgrounds often contain curated learning paths, sensitive coding exercises, or proprietary methodologies that are not meant for general distribution. The ability to bypass draft checks means that even content in a pre-release state can be extracted and made public before its intended launch date. This undermines the integrity of the platform's role-based access control model and erodes trust among users who rely on the system to protect their private or restricted learning environments.
The technical classification of this flaw aligns with CWE-284, which describes Improper Access Control, as well as CWE-639 regarding Authorization Bypass Through User-Controlled Key, since the UUID is used to identify the resource but fails to trigger necessary permission checks during the duplication process. In terms of offensive security frameworks, this behavior maps to MITRE ATT&CK technique T1078, Valid Accounts, where an attacker uses legitimate credentials to access resources they are not authorized for, and potentially T1530, Data from Cloud Storage Object, if the html content is considered stored data being exfiltrated. The lack of server-side validation on the source resource's status during the copy operation highlights a common pattern in web application development where individual endpoints do not inherit or replicate the security logic of their parent resources.
To mitigate this vulnerability, immediate patching to version 1.4.0 or later is required as it addresses these authorization gaps. In environments where upgrading is not immediately feasible, administrators should implement strict input validation and ensure that all API endpoints performing data manipulation explicitly call the same permission verification functions used for read operations. It is also advisable to review other duplication or export features within the application to ensure they do not suffer from similar bypasses. Additionally, implementing rate limiting on UUID-based endpoints can help mitigate automated scanning attempts aimed at discovering valid playground identifiers for exploitation.