Missing Authorization Vulnerability in LearnHouse Product by LearnHouse

CVE-2026-109564

What is CVE-2026-109564?

The LearnHouse application, prior to version 1.4.0, is susceptible to a missing authorization issue. This vulnerability affects the API endpoint POST /api/v1/playgrounds/{uuid}/duplicate. Authenticated users, such as instructors with playground creation rights, can exploit this flaw. If they obtain a restricted or unpublished playground UUID, they can bypass the enforced read-access and draft checks, enabling them to duplicate the HTML content of sensitive playgrounds and republish it publicly without proper authorization.

References