CVE-2026-42176: Scoold Auth Bypass Vulnerability

CVE-2026-42176 Overview

CVE-2026-42176 is a missing authentication vulnerability [CWE-306] in Scoold, an open-source Q&A and knowledge sharing platform for teams. Versions prior to 1.67.0 accept a forged Bearer token as an admin API token on the /api/config/set/admins endpoint. An attacker can modify the scoold.admins configuration value and write an arbitrary email address into the application configuration file. After a Scoold restart, the targeted account is loaded as an administrator and gains access to the admin panel. The flaw provides a reliable persistence path for adversaries who can reach the API.

Critical Impact
An attacker with API reachability can forge admin credentials and obtain persistent administrative access after the next service restart.

Affected Products

Scoold versions prior to 1.67.0
Self-hosted Scoold deployments exposing the configuration API
Scoold instances using the default admin token validation logic

Discovery Timeline

2026-05-08 - CVE-2026-42176 published to the National Vulnerability Database (NVD)
2026-05-12 - Last updated in NVD database

Technical Details for CVE-2026-42176

Vulnerability Analysis

The vulnerability resides in the Scoold configuration API at /api/config/set/admins. The endpoint authorizes requests by inspecting a Bearer token, but the validation logic accepts forged tokens as valid admin API tokens. An attacker who can craft such a token may submit a configuration change that overwrites the scoold.admins value with an attacker-controlled email address.

The write succeeds against the persistent application configuration file. The change does not take effect immediately because the ADMINS set is loaded once at process startup. Once the service restarts, whether through scheduled maintenance, an operational trigger, or a forced crash, Scoold re-reads the configuration and treats the attacker's email as an administrator account. This deferred activation enables a stealthy persistence mechanism that survives credential rotations affecting the original admin accounts.

Root Cause

The root cause is missing authentication for a critical function [CWE-306]. The admin token validation routine does not adequately verify the authenticity or origin of the Bearer token presented to /api/config/set/admins. Privileged configuration mutation is therefore exposed to any caller who can produce a token that passes the weak check.

Attack Vector

The attack is network-reachable and requires no user interaction. The attacker sends an HTTP request to the configuration API carrying a forged Bearer token and a payload that sets scoold.admins to their controlled email. The attacker then either waits for a natural restart or triggers one through operational means. After restart, the attacker authenticates with the matching account and inherits administrative privileges in the Scoold web interface.

No verified exploitation code is publicly available. See the GitHub Security Advisory GHSA-7qfx-c234-xg4g for the maintainer's technical write-up.

Detection Methods for CVE-2026-42176

Indicators of Compromise

Unexpected modifications to the scoold.admins value in the Scoold configuration file
HTTP POST or PUT requests to /api/config/set/admins from unrecognized source addresses
New email addresses appearing in the admin panel user list after a service restart
Authentication events showing unfamiliar accounts accessing administrative routes such as /admin

Detection Strategies

Monitor application logs for requests to /api/config/** endpoints and alert on configuration-mutating verbs from non-administrative IP ranges
Track file integrity on the Scoold configuration file and flag changes to the scoold.admins property outside of approved change windows
Correlate Scoold restart events with preceding configuration API calls within a defined time window

Monitoring Recommendations

Forward Scoold application and access logs to a centralized logging or SIEM platform for retrospective analysis
Enable audit logging for administrative panel access and review new admin accounts after any service restart
Baseline expected callers of the Scoold API and alert on Bearer token usage from unknown clients

How to Mitigate CVE-2026-42176

Immediate Actions Required

Upgrade Scoold to version 1.67.0 or later, which contains the patched token validation logic
Audit the current scoold.admins configuration value and remove any unauthorized email addresses before the next restart
Rotate any administrative API tokens and review recent access to the admin panel
Restrict network access to the Scoold configuration API to trusted management networks only

Patch Information

The issue is fixed in Scoold 1.67.0. Release details are available in the GitHub Release 1.67.0 notes. Administrators should plan a controlled restart after upgrading so that the corrected validation path is loaded into the running process.

Workarounds

Place the Scoold instance behind a reverse proxy that blocks external requests to /api/config/** paths until the upgrade is complete
Enforce network-level access control lists so that only known management hosts can reach the API surface
Inspect the persisted configuration file before each planned restart to confirm the scoold.admins value has not been tampered with

bash

# Example reverse proxy rule to block external access to the configuration API
location /api/config/ {
    allow 10.0.0.0/8;
    deny all;
    proxy_pass http://scoold_backend;
}