CVE-2026-34832
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk23th percentile - higher than 23% of all known CVEs
Summary
Scoold prior to version 1.66.1 does not enforce authorization when deleting feedback – any logged-in user can delete another user's feedback by providing its ID. Object ownership or moderator privileges are not checked.
Risk Assessment
Users may lose their feedback posts irreversibly, compromising data integrity and trust in the platform.
Recommendation
Upgrade Scoold to version 1.66.1 or later.
Original NVD description (English source)
Scoold is a Q&A and a knowledge sharing platform for teams. Prior to version 1.66.1, Scoold contains an authenticated authorization flaw in feedback deletion that allows any logged-in, low-privilege user to delete another user's feedback post by submitting its ID to POST /feedback/{id}/delete. The handler enforces authentication but does not enforce object ownership (or moderator/admin authorization) before deletion. In verification, a second non-privileged account successfully deleted a victim account's feedback item, and the item immediately disappeared from the feedback listing/detail views. This issue has been patched in version 1.66.1.