PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-109564 learnhouse CVE debrief

LearnHouse before 1.4.0 contains a missing authorization vulnerability in the POST /api/v1/playgrounds/{uuid}/duplicate endpoint. This allows authenticated users with playground creation rights, such as Instructors, to copy the html_content of a RESTRICTED or unpublished playground if they know its UUID, and republish it publicly. The vulnerability can lead to unauthorized content replication, potentially exposing sensitive information. Defenders should assess exposure and prioritize verification and remediation.

Vendor
learnhouse
Product
Unknown
CVSS
LOW 2.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-10-12
Original CVE updated
2026-10-13
Advisory published
2026-10-12
Advisory updated
2026-10-13

Who should care

Defenders responsible for LearnHouse instances, particularly those with authenticated users having playground creation rights, should assess exposure and prioritize verification and remediation.

Why it matters

CVE-2026-109564 is a missing authorization vulnerability in LearnHouse before 1.4.0 that allows authenticated users to duplicate playgrounds without proper checks, potentially leading to unauthorized content replication. Defenders should prioritize verifying exposure, especially in instances with authenticated users having playground creation rights, and update to version 1.4.0 or later.

  • Potential unauthorized content replication by authenticated users
  • Increased risk of publicly accessible sensitive content
  • Need for verification of LearnHouse instance exposure
  • Prioritization of updates to version 1.4.0 or later

Technical summary

The vulnerability exists in the POST /api/v1/playgrounds/{uuid}/duplicate endpoint of LearnHouse before 1.4.0. Authenticated users with playground creation rights can duplicate a playground and access its html_content without proper authorization checks. This can lead to unauthorized content replication. Defenders should prioritize verifying exposure of LearnHouse instances to authenticated users with playground creation rights, and assess the potential for unauthorized content replication. The vulnerability allows authenticated users to duplicate playgrounds without proper authorization checks, potentially leading to unauthorized content replication.

Defensive priority

Defenders should prioritize verifying exposure of LearnHouse instances to authenticated users with playground creation rights, and assess the potential for unauthorized content replication.

Recommended defensive actions

  • Verify LearnHouse instances are updated to version 1.4.0 or later
  • Restrict access to the POST /api/v1/playgrounds/{uuid}/duplicate endpoint to authorized users
  • Monitor for unauthorized playground duplication attempts
  • Implement additional access controls to prevent exploitation
  • Review compensating controls for exposed systems while remediation is scheduled and verified
  • Check relevant monitoring, detection, and logs for exposed assets that need extra review
  • Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and source item provide details on the missing authorization vulnerability in LearnHouse before 1.4.0. The vulnerability allows authenticated users to duplicate playgrounds without proper authorization checks.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-109564 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-109564

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-109564 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-109564

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • LearnHouse before 1.4.0 Missing Authorization via Playground Duplicate Endpoint

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109564.json

    cve_program_cvelist_v5

  • Source reference

    Unverified legacy reference

    URL: https://github.com/learnhouse/learnhouse/pull/1120

    Supplemental source - issue-tracking, patch

  • Source reference

    Unverified legacy reference

    URL: https://github.com/learnhouse/learnhouse/commit/9a1319185a596ea9b40651dbfd96f05195c0be37

    Supplemental source - patch

  • Source reference

    Unverified legacy reference

    URL: https://github.com/learnhouse/learnhouse

    Supplemental source - product

  • Source reference

    Unverified legacy reference

    URL: https://www.vulncheck.com/advisories/learnhouse-before-1.4.0-missing-authorization-via-playground-duplicate-endpoint

    Supplemental source - third-party-advisory

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.