learnhouse CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

LOW learnhouse CVE published 2026-10-12

CVE-2026-109564

LearnHouse before 1.4.0 contains a missing authorization vulnerability in the POST /api/v1/playgrounds/{uuid}/duplicate endpoint. This allows authenticated users with playground creation rights, such as Instructors, to copy the html_content of a RESTRICTED or unpublished playground if they know its UUID, and republish it publicly. The vulnerability can lead to unauthorized content replication, potentially [truncated]