CVE-2026-54676 is a vulnerability in Scoold, a Q&A and knowledge sharing platform for teams. Prior to version 1.69.0, users with personal API tokens can retrieve replies from questions in private spaces they cannot access. This issue allows unauthorized access to confidential team or project discussions. The vulnerability exists in the ApiController.getPostReplies() method, which does not apply canAccessS [truncated]
CVE-2026-39354 is an authenticated authorization flaw in Scoold, a Q&A and knowledge sharing platform for teams. Prior to version 1.66.2, a low-privilege user can overwrite another user's existing question by supplying the public ID of that question as the postId parameter in a POST /questions/ask request. This is possible because question IDs are exposed in normal question URLs. As a result, an attacker [truncated]
