CVE-2026-120199: LearnHouse before 1.1.1 Missing Authorization via Assignment Submissions API

Published Oct 31, 2026

Updated

LearnHouse before 1.1.1 contains a missing authorization vulnerability in the assignment API that allows authenticated users to read other users' grades and submissions. Attackers can supply another userid to the submissions grade endpoint or query submission read functions to view other students' work, grades and instructor feedback.

Event History

Oct 31, 2026

CVE Published

via MITRE·05:25 PM

Data Sourced

via MITRE·05:25 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·06:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

An attacker must be authenticated as a LearnHouse user. The vulnerable assignment API can then be used to access other users' assignment submissions, grades, and instructor feedback.

What access does an attacker need?

The attacker needs a valid authenticated account with low-level privileges. No user interaction is required, and the attacker can target another user's data by supplying that user's user_id to the submissions grade endpoint or by using submission read functions.

Are confidentiality, integrity, or availability affected?

The reported impact is limited to confidentiality. The vulnerability exposes other students' work, grades, and instructor feedback; no integrity or availability impact is indicated.

Which versions are affected?

LearnHouse versions before 1.1.1 are affected. Upgrading to 1.1.1 or later addresses the affected version range.

CVE-2026-120199: LearnHouse before 1.1.1 Missing Authorization via Assignment Submissions API

Event History

Frequently Asked Questions

Who can exploit this issue?

What access does an attacker need?

Are confidentiality, integrity, or availability affected?

Which versions are affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What access does an attacker need?

Are confidentiality, integrity, or availability affected?

Which versions are affected?