CVE-2026-54676: Scoold: GET /api/posts/{id}/answers leaks private-space replies when personal API tokens are enabled
Scoold is a Q&A and a knowledge sharing platform for teams. Prior to 1.69.0, users with personal API tokens can retrieve replies from questions in private spaces they cannot access because src/main/java/com/erudika/scoold/api/ApiController.java in ApiController.getPostReplies() does not apply canAccessSpace before returning data from GET /api/posts/{id}/answers. The issue is reachable when scoold.apiuseraccessenabled and scoold.apienabled are true and a token holder knows or enumerates a private question identifier. Under those conditions, the question endpoint can deny access while the answers endpoint returns the private reply bodies, exposing confidential team or project discussions. This issue is fixed in version 1.69.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
scooldto a version that resolves this vulnerability.Fixed in 1.69.0
Event History
Frequently Asked Questions
Which deployments are exposed?
Scoold versions prior to 1.69.0 are affected when both scoold.api_enabled and scoold.api_user_access_enabled are enabled. The issue concerns private spaces containing questions with replies.
What does an attacker need to exploit this?
An attacker needs a personal API token and the identifier of a question in a private space they cannot access. They may know or enumerate the private question identifier; no interactive user action is required.
What information can be exposed?
The GET /api/posts/{id}/answers endpoint can return private reply bodies from inaccessible private spaces. The related question endpoint may deny access, so checking only question retrieval does not rule out exposure through the answers endpoint.
What should teams do if they cannot upgrade immediately?
Disable personal API user access by setting scoold.api_user_access_enabled to false, or disable the API with scoold.api_enabled set to false, until upgrading to 1.69.0. This removes the stated reachable conditions for the issue.
How can administrators assess whether exposure may have occurred?
Determine whether both API settings were enabled on an affected version and whether personal API tokens were issued. Review API activity for requests to /api/posts/{id}/answers involving identifiers for questions in private spaces.