CVE-2026-39354 Erudika CVE debrief

Who should care

Teams using Scoold for Q&A and knowledge sharing should be aware of this vulnerability. Specifically, administrators and security teams of organizations that have not upgraded to version 1.66.2 or later are at risk. Low-privilege users with access to the platform can exploit this vulnerability to overwrite existing questions, potentially leading to integrity loss of user-generated content.

Technical summary

The vulnerability exists in the Scoold platform's handling of question IDs. When a low-privilege user supplies a public ID of an existing question as the postId parameter in a POST /questions/ask request, the platform allows the overwrite of that existing question. This is because question IDs are exposed in URLs, making it possible for an attacker to find and exploit existing question IDs. The CVSS score for this vulnerability is 6.5, with a severity rating of MEDIUM. The vulnerability is categorized under CWE-639.

Defensive priority

Medium priority should be given to upgrading Scoold to version 1.66.2 or later. In the meantime, monitoring for suspicious activity related to question creation and modification can help detect potential exploitation attempts.

Recommended defensive actions

• Upgrade Scoold to version 1.66.2 or later
• Monitor Scoold logs for suspicious question creation and modification activity
• Restrict access to sensitive areas of the Scoold platform for low-privilege users
• Consider implementing additional logging and monitoring to detect potential exploitation attempts
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record was published on 2026-04-07T19:16:46.357Z and was last modified on 2026-07-24T21:10:00.143Z. The NVD entry is currently Analyzed. The vulnerability is fixed in Scoold version 1.66.2. Evidence limits suggest that additional verification may be required to confirm affected scope and severity. Defenders should verify Scoold version deployments and review compensating controls for exposed systems.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.