CVE-2026-111603: PlayEdu through 2.3 Missing Authorization via Student CourseController Endpoints
PlayEdu through 2.3 contains a missing authorization vulnerability in the CourseController that allows authenticated students to access department-restricted courses by omitting the department visibility check. Attackers can enumerate sequential course and attachment IDs via the course details and attachment download endpoints to obtain course structure and attachment files from other departments.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated student account is required. The issue affects students who can reach the CourseController course-details and attachment-download endpoints and use them to request resources belonging to other departments.
What information could an attacker obtain?
An attacker can enumerate sequential course and attachment IDs to access course structure information and download attachment files for department-restricted courses.
Does exploitation require user interaction or complex conditions?
No user interaction is required, and the attack complexity is low. The attacker must first authenticate as a student and then omit the department visibility check when requesting course or attachment resources.
How can administrators determine whether they may be affected?
Review whether the deployment uses PlayEdu through version 2.3 and whether authenticated students can access CourseController course-details or attachment-download endpoints for sequential IDs outside their department. Successful access to another department's restricted course details or attachments indicates exposure.