CVE-2026-55842: Scoold: CORS wildcard origin with credentials enabled allows cross-origin authenticated API access from any domain
Scoold is a Q&A and a knowledge sharing platform for teams. Prior to 1.69.1, the apiCorsConfiguration() method in src/main/java/com/erudika/scoold/ScooldServer.java combines addAllowedOriginPattern("") with setAllowCredentials(true), causing Spring to reflect any requesting origin while allowing cookies or session tokens. A malicious website visited by a logged-in Scoold user can therefore issue authenticated API requests, read user data, questions, and configuration, and trigger state-changing operations on the user's behalf. This issue is fixed in version 1.69.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Scooldto a version that resolves this vulnerability.Fixed in 1.69.1
Event History
Frequently Asked Questions
Who is exposed to this issue?
Scoold deployments running versions before 1.69.1 are exposed when users are logged in through cookies or session tokens and visit an attacker-controlled website.
What does an attacker need to exploit it?
The attacker needs to lure a logged-in Scoold user to a malicious website. No Scoold account or prior privileges are required.
What can an attacker do through a successful exploit?
A malicious site can make authenticated cross-origin API requests, read user data, questions, and configuration, and perform state-changing actions with the victim's permissions.
What is the remediation?
Upgrade Scoold to version 1.69.1, which fixes the unsafe combination of wildcard allowed origins and credentialed CORS requests.