PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-39354 Erudika CVE debrief

CVE-2026-39354 is an authenticated authorization flaw in Scoold, a Q&A and knowledge sharing platform for teams. Prior to version 1.66.2, a low-privilege user can overwrite another user's existing question by supplying the public ID of that question as the postId parameter in a POST /questions/ask request. This is possible because question IDs are exposed in normal question URLs. As a result, an attacker can cause controlled content to be stored under an existing question object, leading to direct integrity loss of user-generated content and corruption of the existing discussion thread. This vulnerability is fixed in version 1.66.2.

Vendor
Erudika
Product
Scoold
CVSS
MEDIUM 6.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-04-07
Original CVE updated
2026-07-24
Advisory published
2026-04-07
Advisory updated
2026-07-24

Who should care

Teams using Scoold for Q&A and knowledge sharing should be aware of this vulnerability. Specifically, administrators and security teams of organizations that have not upgraded to version 1.66.2 or later are at risk. Low-privilege users with access to the platform can exploit this vulnerability to overwrite existing questions, potentially leading to integrity loss of user-generated content.

Technical summary

The vulnerability exists in the Scoold platform's handling of question IDs. When a low-privilege user supplies a public ID of an existing question as the postId parameter in a POST /questions/ask request, the platform allows the overwrite of that existing question. This is because question IDs are exposed in URLs, making it possible for an attacker to find and exploit existing question IDs. The CVSS score for this vulnerability is 6.5, with a severity rating of MEDIUM. The vulnerability is categorized under CWE-639.

Defensive priority

Medium priority should be given to upgrading Scoold to version 1.66.2 or later. In the meantime, monitoring for suspicious activity related to question creation and modification can help detect potential exploitation attempts.

Recommended defensive actions

  • Upgrade Scoold to version 1.66.2 or later
  • Monitor Scoold logs for suspicious question creation and modification activity
  • Restrict access to sensitive areas of the Scoold platform for low-privilege users
  • Consider implementing additional logging and monitoring to detect potential exploitation attempts
  • Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
  • Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
  • Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record was published on 2026-04-07T19:16:46.357Z and was last modified on 2026-07-24T21:10:00.143Z. The NVD entry is currently Analyzed. The vulnerability is fixed in Scoold version 1.66.2. Evidence limits suggest that additional verification may be required to confirm affected scope and severity. Defenders should verify Scoold version deployments and review compensating controls for exposed systems.

Official resources

AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-04-07T19:16:46.357Z and has not been modified since then. The NVD entry is currently Analyzed.