CVE-2026-63240: Koollab LMS Information Disclosure Flaw

CVE-2026-63240 Overview

CVE-2026-63240 is an information disclosure vulnerability in Koollab Learning Management System (LMS). Authenticated learners can retrieve correct quiz answers from the course status endpoint without completing the assessment. The flaw undermines the integrity of quiz-based evaluations by exposing sensitive assessment data to any logged-in user. The vulnerability is categorized under [CWE-200] Exposure of Sensitive Information to an Unauthorized Actor.

Critical Impact
Authenticated attackers can extract correct quiz answers directly from the course status API, allowing learners to bypass legitimate assessment workflows and compromise evaluation integrity.

Affected Products

Koollab LMS

Discovery Timeline

2026-07-29 - CVE-2026-63240 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-63240

Vulnerability Analysis

The Koollab LMS course status endpoint returns response data that includes correct quiz answers alongside course progress information. Any authenticated learner can query this endpoint and read the answer key without submitting a completed assessment. The endpoint fails to filter sensitive fields based on assessment state or user role. As a result, learners retrieve answers meant to remain server-side until grading occurs. This is a business logic flaw combined with over-permissive data exposure in the API response body.

Root Cause

The root cause is improper data segregation in the course status API. The backend serializes internal quiz metadata, including answer keys, into the response consumed by the learner client. There is no server-side filter that redacts answer fields prior to assessment submission. The vulnerability aligns with [CWE-200] and reflects a failure to apply the principle of least data exposure to learner-facing endpoints.

Attack Vector

Exploitation requires a valid learner account and network access to the LMS. An attacker authenticates, enrolls in a course, and issues a request to the course status endpoint. The response contains the correct answers embedded in the returned course state object. The attacker parses the answers and submits them through the standard quiz workflow. No elevated privileges, user interaction, or specialized tooling is required beyond an HTTP client and valid session credentials.

No public proof-of-concept code or exploit is documented in the referenced advisory. See the CSA Security Advisory AL-2026-094 for technical details.

Detection Methods for CVE-2026-63240

Indicators of Compromise

Learner accounts submitting quizzes with perfect or near-perfect scores in unusually short time windows.
Repeated GET requests to the course status endpoint immediately preceding quiz submissions.
API access patterns where the course status endpoint is queried without corresponding lesson-progression events.

Detection Strategies

Inspect API responses in application logs for the presence of answer-key fields transmitted to learner sessions.
Correlate authentication logs with course status endpoint access to identify users querying assessment data outside expected workflows.
Baseline normal learner API interaction sequences and alert on deviations that skip content consumption before quiz submission.

Monitoring Recommendations

Enable verbose API access logging on the Koollab LMS course status endpoint and forward logs to a centralized analytics platform.
Monitor per-user quiz completion times and flag statistical outliers for review.
Track response payload sizes on assessment-related endpoints to detect unexpected data being returned to learner clients.

How to Mitigate CVE-2026-63240

Immediate Actions Required

Contact Koollab for a security update addressing the course status endpoint data exposure.
Review learner activity logs for evidence of assessment answer harvesting since deployment.
Restrict or gate access to the affected endpoint at the reverse proxy or web application firewall until a vendor fix is applied.

Patch Information

Refer to the CSA Security Advisory AL-2026-094 for vendor guidance and remediation instructions. No specific fixed version is listed in the NVD entry at the time of publication.

Workarounds

Configure API gateway rules to strip answer-key fields from course status responses before they reach learner clients.
Invalidate cached quiz metadata and rotate any assessments suspected of being compromised.
Enforce stricter role-based access control so that answer data is served only to instructor and grader roles.

bash

# Example WAF rule concept to block answer-key fields in responses
# Adjust field names to match Koollab LMS response schema
SecRule RESPONSE_BODY "@rx \"correct_answer\":" \
  "id:1026063240,phase:4,deny,status:403,\
  msg:'Blocked response leaking quiz answer key (CVE-2026-63240)'"