Scoold: Cross-Account Feedback Deletion (IDOR)

Description

Scoold is a Q&A and a knowledge sharing platform for teams. Prior to version 1.66.1, Scoold contains an authenticated authorization flaw in feedback deletion that allows any logged-in, low-privilege user to delete another user's feedback post by submitting its ID to POST /feedback/{id}/delete. The handler enforces authentication but does not enforce object ownership (or moderator/admin authorization) before deletion. In verification, a second non-privileged account successfully deleted a victim account's feedback item, and the item immediately disappeared from the feedback listing/detail views. This issue has been patched in version 1.66.1.

Scores

EPSS (exploitation in 30 days)

0.32% · top 75% of all CVEs (5 Nov 2026)

CISA SSVC

Exploitation: poc · Automatable: no · Technical impact: partial

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 6.5.

Weakness

• CWE-639: Authorization Bypass Through User-Controlled Key (opens in a new tab)All about CWE-639 and its CVEs

Affected products

• Erudika · scoold

  • affected < 1.66.1

References (3)

• https://github.com/Erudika/scoold/security/advisories/GHSA-g5fv-xw88-vw44 (opens in a new tab)x_refsource_CONFIRM
• https://github.com/Erudika/scoold/commit/5def88c25405cc60482292bcceb45dc024e899fe (opens in a new tab)x_refsource_MISC
• https://github.com/Erudika/scoold/releases/tag/1.66.1 (opens in a new tab)x_refsource_MISC

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisories (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2026-34832](https://trackcve.app/badge/CVE-2026-34832.svg)](https://trackcve.app/cve/CVE-2026-34832)

Record last updated 3 Apr 2026, 14:43 UTC.