CVE-2026-54676 Erudika CVE debrief

Who should care

Defenders responsible for Scoold deployments should assess exposure and prioritize upgrading to version 1.69.0 or later to prevent unauthorized access to private question replies. This includes operators, platform administrators, vulnerability management teams, and security teams who need to ensure the security of Scoold deployments.

Why it matters

CVE-2026-54676 is a vulnerability in Scoold that allows users with personal API tokens to retrieve replies from questions in private spaces they cannot access. Defenders should prioritize upgrading to Scoold version 1.69.0 or later to prevent unauthorized access to private question replies.

• Potential unauthorized access to confidential team or project discussions
• Exposure of private question replies
• Need for verification of API token access restrictions
• Priority for upgrading to Scoold version 1.69.0 or later

Technical summary

The vulnerability exists in the ApiController.getPostReplies() method in src/main/java/com/erudika/scoold/api/ApiController.java, which does not apply canAccessSpace before returning data from GET /api/posts/{id}/answers. This allows users with personal API tokens to retrieve replies from questions in private spaces they cannot access. The issue is reachable when scoold.api_user_access_enabled and scoold.api_enabled are true and a token holder knows or enumerates a private question identifier. This issue is fixed in version 1.69.0.

Defensive priority

Defenders should prioritize upgrading to Scoold version 1.69.0 or later to prevent unauthorized access to private question replies.

Recommended defensive actions

• Upgrade to Scoold version 1.69.0 or later
• Review and restrict API token access
• Monitor for suspicious API activity
• Confirm whether affected Scoold deployments exist in managed environments and assign an owner for follow-up
• Review compensating controls for exposed Scoold systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed Scoold assets that need extra review
• Track exceptions, retest remediated Scoold assets, and close the item only after evidence is documented

Evidence notes

The vulnerability exists in the ApiController.getPostReplies() method in src/main/java/com/erudika/scoold/api/ApiController.java, which does not apply canAccessSpace before returning data from GET /api/posts/{id}/answers.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.