https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 08 Oct 2026 08:45:38 +0000 https://cve.radiocsirt.org/vuln/cve-2026-34832 <p><strong>Affected:</strong> Erudika scoold</p> <p>Scoold is a Q&amp;A and a knowledge sharing platform for teams. Prior to version 1.66.1, Scoold contains an authenticated authorization flaw in feedback deletion that allows any logged-in, low-privilege user to delete another user&#39;s feedback post by submitting its ID to POST /feedback/{id}/delete. The handler enforces authentication but does not enforce object ownership (or moderator/admin authorization) before deletion. In verification, a second non-privileged account successfully deleted a victim account&#39;s feedback item, and the item immediately disappeared from the feedback listing/detail views. This issue has been patched in version 1.66.1.</p> <p><strong>Affected:</strong> Erudika scoold</p> <p>Scoold is a Q&amp;A and a knowledge sharing platform for teams. Prior to version 1.66.1, Scoold contains an authenticated authorization flaw in feedback deletion that allows any logged-in, low-privilege user to delete another user&#39;s feedback post by submitting its ID to POST /feedback/{id}/delete. The handler enforces authentication but does not enforce object ownership (or moderator/admin authorization) before deletion. In verification, a second non-privileged account successfully deleted a victim account&#39;s feedback item, and the item immediately disappeared from the feedback listing/detail views. This issue has been patched in version 1.66.1.</p> https://cve.radiocsirt.org/vuln/cve-2026-34832