CVE-2026-63236 Three Learning CVE debrief

Who should care

Defenders responsible for Koollab LMS deployments should assess exposure and verify user access controls. They should also review data access to prevent potential data exposure and ensure that access control configurations are in place. Additionally, defenders should consider the potential operational impacts, including read access to sensitive user data and potential data exposure for users.

Why it matters

CVE-2026-63236 is a low-severity vulnerability in Koollab LMS that allows unauthenticated attackers to access user data via the SCORM API endpoint. Defenders responsible for Koollab LMS deployments should assess exposure, verify user access controls, and review data access to prevent potential data exposure.

• Read access to sensitive user data
• Potential data exposure for users
• Verification of access control configurations required
• Review of user data access necessary

Technical summary

CVE-2026-63236 is an improper access control vulnerability in Koollab LMS that allows unauthenticated attackers to read user data, including name, internal identifier, scores, lesson status, lesson position, and cached lesson state, via the SCORM API endpoint.

Defensive priority

Assess exposure and verify user access controls for Koollab LMS SCORM API endpoints.

Recommended defensive actions

• Verify user access controls for Koollab LMS SCORM API endpoints
• Assess exposure of user data
• Review and update access control configurations

Evidence notes

The CVE record and NVD entry provide details on the improper access control vulnerability in Koollab LMS. The vulnerability allows unauthenticated attackers to access user data via the SCORM API endpoint. Defenders should verify user access controls and review data access to prevent potential data exposure. The source details are limited, and explicit evidence-limit language and defensive verification tasks are necessary to ensure accurate assessment.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.