CVE-2026-109564: LearnHouse before 1.4.0 Missing Authorization via Playground Duplicate Endpoint
LearnHouse before 1.4.0 contains a missing authorization vulnerability in POST /api/v1/playgrounds/{uuid}/duplicate that skips the read-access and draft checks enforced by getplayground. Authenticated users with playground creation rights, such as Instructors, who know a RESTRICTED or unpublished playground UUID can copy its htmlcontent and republish it publicly.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
LearnHouseto a version that resolves this vulnerability.Fixed in 1.4.0
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated user with playground creation rights, such as an Instructor, can exploit it. The user must know the UUID of a RESTRICTED or unpublished playground.
What information can be exposed?
The vulnerable duplicate endpoint can copy the target playground's html_content. The copied playground can then be republished publicly.
Are restricted and unpublished playgrounds affected?
Yes. The endpoint skips the read-access and draft checks that would normally protect RESTRICTED and unpublished playgrounds.
What version addresses the issue?
LearnHouse versions before 1.4.0 are affected. Upgrading to version 1.4.0 or later addresses the stated affected-version range.