CVE-2026-120199 learnhouse CVE debrief

Who should care

Educational institutions and organizations using LearnHouse versions before 1.1.1 should assess exposure and verify patches. Roles include system administrators, security teams, and educators using the LearnHouse platform. Affected deployments require verification of LearnHouse version and application of patches. The vulnerability impacts system administrators, security teams, and educators using the LearnHouse platform.

Why it matters

CVE-2026-120199 LearnHouse missing authorization vulnerability allows authenticated users to read other users' grades and submissions. Educational institutions and organizations using LearnHouse versions before 1.1.1 should assess exposure and verify patches.

• Authenticated users can access unauthorized grade and submission data
• Potential for data exposure and unauthorized access to sensitive student information
• Requires verification of LearnHouse version and application of patches
• Monitoring for suspicious activity on the submissions grade endpoint is necessary

Technical summary

The LearnHouse application before version 1.1.1 contains a missing authorization vulnerability in the assignment API. This allows authenticated users to read other users' grades and submissions by supplying another user_id to the submissions grade endpoint or querying submission read functions. The vulnerability impacts educational institutions and organizations using LearnHouse versions before 1.1.1. System administrators, security teams, and educators using the LearnHouse platform should verify and apply patches.

Defensive priority

Verify and apply patches for LearnHouse versions before 1.1.1

Recommended defensive actions

• Verify LearnHouse version and apply patches for versions before 1.1.1
• Restrict access to the assignment API
• Monitor for suspicious activity on the submissions grade endpoint
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the missing authorization vulnerability in LearnHouse before 1.1.1. Official sources include the CVE Program and NIST NVD. The vulnerability was disclosed on 2026-10-31T18:17:07.010Z. The LearnHouse repository and assignment API code are referenced as sources. The CVE Program record and NVD detail page provide source-provided CVE metadata and vulnerability assessment.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.