CVE-2025-56747
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk21th percentile - higher than 21% of all known CVEs
Summary
Creativeitem Academy LMS up to and including 5.13 contains a privilege escalation vulnerability in the Api_instructor controller where regular authenticated users can access instructor-only functions without proper role validation, allowing unauthorized course creation and management.
Risk Assessment
This may lead to unauthorized creation and modification of course content, potentially harming the platform's reputation and security. Immediate update is required.
Recommendation
Update Creativeitem Academy LMS to a version later than 5.13. Implement proper role validation in the Api_instructor controller.
Other vulnerabilities in Creativeitem Academy LMS
See all- CVE-2025-56749Critical
Creativeitem Academy LMS up to and including 6.14 uses a hardcoded default JWT secret for token signing. This predictable secret allows attackers to forge valid JWT tokens, leading to authentication bypass and unauthorized access to any user account.
- CVE-2025-56748Medium
Creativeitem Academy LMS up to and including 5.13 uses predictable password reset tokens based on Base64 encoded templates without rate limiting, allowing brute force attacks to guess valid reset tokens and compromise user accounts.
- CVE-2025-56746Low
Creativeitem Academy LMS up to and including 5.13 does not regenerate session IDs upon successful authentication, enabling session fixation attacks where attackers can hijack user sessions by predetermining session identifiers.
- CVE-2023-3752Low
A vulnerability was found in Creativeitem Academy LMS 5.15, rated as problematic. Manipulation of the sort_by argument in the /home/courses file leads to cross-site scripting attacks.
Original NVD description (English source)
Creativeitem Academy LMS up to and including 5.13 contains a privilege escalation vulnerability in the Api_instructor controller where regular authenticated users can access instructor-only functions without proper role validation, allowing unauthorized course creation and management.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS