CVE-2026-109564

LOW 3.1

LearnHouse before 1.4.0 Missing Authorization via Playground Duplicate Endpoint

CVSS Score

3.1

EPSS Score

0.0%

EPSS Percentile

0th

LearnHouse before 1.4.0 contains a missing authorization vulnerability in POST /api/v1/playgrounds/{uuid}/duplicate that skips the read-access and draft checks enforced by get_playground. Authenticated users with playground creation rights, such as Instructors, who know a RESTRICTED or unpublished playground UUID can copy its html_content and republish it publicly.

CWE	CWE-862
Vendor	learnhouse
Product	learnhouse
Published	Oct 12, 2026

Stay Ahead of the Next One

Get instant alerts for learnhouse learnhouse

Be the first to know when new low vulnerabilities affecting learnhouse learnhouse are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Affected Versions

learnhouse / LearnHouse

0 < 1.4.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/learnhouse/learnhouse/pull/1120 github.com: https://github.com/learnhouse/learnhouse/commit/9a1319185a596ea9b40651dbfd96f05195c0be37 github.com: https://github.com/learnhouse/learnhouse vulncheck.com: https://www.vulncheck.com/advisories/learnhouse-before-1.4.0-missing-authorization-via-playground-duplicate-endpoint

Credits

Mansur Mavlankulov