CVE-2026-97864: GibbonEdu Gibbon Auth Bypass Vulnerability

CVE-2026-97864 Overview

CVE-2026-97864 is a missing authentication vulnerability [CWE-287] affecting GibbonEdu Gibbon versions up to 30.0.01. The flaw resides in the makeBlock function within modules/Planner/units_add_blockAjax.php, which is part of the Unit Planner component. Attackers can manipulate the gibbonUnitBlockID and mode arguments remotely without authentication. The exploit has been publicly disclosed, raising the probability of opportunistic abuse against exposed instances. Upgrading to version 31.0.00 resolves the issue, with the fix delivered in commit 07e719368eae8dfb4e22e19424ceab6074164ebc.

Critical Impact

Unauthenticated remote attackers can invoke the makeBlock function in the Unit Planner, bypassing access controls on the affected endpoint.

Affected Products

• GibbonEdu Gibbon versions up to and including 30.0.01
• Component: Unit Planner (modules/Planner/units_add_blockAjax.php)
• Function: makeBlock

Discovery Timeline

• 2026-09-25 - CVE-2026-97864 published to the National Vulnerability Database (NVD)
• 2026-09-28 - Last updated in NVD database

Technical Details for CVE-2026-97864

Vulnerability Analysis

The vulnerability stems from missing authentication checks in the makeBlock function of modules/Planner/units_add_blockAjax.php. The endpoint processes AJAX requests to add unit blocks within the Unit Planner module, but does not verify that the requester holds a valid authenticated session before accepting input. Attackers can supply arbitrary values for the gibbonUnitBlockID and mode parameters without presenting credentials.

Because the attack is network-reachable and requires no user interaction, any internet-exposed Gibbon instance is reachable by automated scanners. The confidentiality impact is limited to data handled by the planner endpoint, but public disclosure of a working exploit increases risk for unpatched deployments.

Root Cause

The root cause is a missing authentication control [CWE-287] on an AJAX endpoint. The handler processes input parameters before validating session state or verifying user permissions. In a correctly hardened implementation, every AJAX endpoint must enforce session validation and role-based authorization prior to executing business logic.

Attack Vector

An unauthenticated attacker sends a crafted HTTP request to modules/Planner/units_add_blockAjax.php with manipulated gibbonUnitBlockID and mode parameters. No prior access, credentials, or user interaction is required. The attack can be scripted against any reachable Gibbon deployment running a vulnerable release.

// Patch excerpt from src/Forms/Input/CodeEditor.template.php
// Related hardening work in commit 07e719368eae8dfb4e22e19424ceab6074164ebc
<div id="editor<?= $id; ?>" class="w-full" style="height: <?= $height; ?>px;"><?= htmlentities($text ?? '', ENT_QUOTES, 'UTF-8'); ?></div>

<script type="text/javascript">
    (async () => {
        const editorId = "editor<?= $id; ?>";
        const textareaId = "<?= $id; ?>";
        const useAutocomplete = <?= !empty($autocomplete) ? 'true' : 'false'; ?>;

        await import("./lib/ace/ace.js");

        if (useAutocomplete) {
            await import("./lib/ace/ext-language_tools.js");
        }

        ace.config.set('basePath', './lib/ace/');

        const editorElement = document.getElementById(editorId);
        const textareaElement = document.getElementById(textareaId);

        if (!editorElement || !textareaElement) return;

        // Avoid duplicate initialization on the same DOM node
        if (editorElement.env && editorElement.env.editor) return;

        const editor = ace.edit(editorId);
    })();
</script>

Source: GitHub Commit 07e71936

Detection Methods for CVE-2026-97864

Indicators of Compromise

• Unauthenticated HTTP POST or GET requests to modules/Planner/units_add_blockAjax.php lacking a valid session cookie.
• Requests containing unusual or sequential values in the gibbonUnitBlockID and mode parameters originating from the same source IP.
• Unexpected creation or modification of unit planner block records outside normal teacher activity windows.

Detection Strategies

• Review web server access logs for requests to units_add_blockAjax.php that are not preceded by an authenticated login event.
• Correlate application logs for Unit Planner block changes against the known list of authenticated staff accounts.
• Deploy a Web Application Firewall (WAF) rule to flag requests to the vulnerable endpoint without a corresponding Gibbon session cookie.

Monitoring Recommendations

• Monitor outbound and inbound traffic to Gibbon application servers for scanner signatures referencing units_add_blockAjax.php.
• Alert on sudden spikes in AJAX requests to the Planner module from a single IP or user agent.
• Track version information served by Gibbon instances to identify systems still running 30.0.01 or earlier.

How to Mitigate CVE-2026-97864

Immediate Actions Required

• Upgrade Gibbon to version 31.0.00 or later, which contains the fix referenced by commit 07e719368eae8dfb4e22e19424ceab6074164ebc.
• Restrict external access to the Gibbon application until the patch is applied, limiting exposure to trusted networks.
• Review Unit Planner data for unexpected modifications created after the public disclosure date.

Patch Information

The maintainers resolved CVE-2026-97864 in Gibbon 31.0.00. The fix is tracked in GitHub Commit 07e71936 with related work in Pull Request #2090 and Pull Request #2095. Administrators can review the full release delta in the GitHub Version Comparison. Additional metadata is available in the VulDB CVE Report.

Workarounds

• Block external access to modules/Planner/units_add_blockAjax.php at the reverse proxy or WAF layer until the upgrade is deployed.
• Enforce IP allowlisting on the Gibbon application to limit requests to known school networks.
• Require authenticated session cookies at the proxy layer for all requests to the /modules/Planner/ path.

# Example Nginx rule to block unauthenticated access to the vulnerable endpoint
location = /modules/Planner/units_add_blockAjax.php {
    if ($cookie_GibbonSession = "") {
        return 403;
    }
    proxy_pass http://gibbon_backend;
}