API Token Vulnerability in Scoold Q&A Platform Exposes Private Replies

CVE-2026-54676

What is CVE-2026-54676?

A vulnerability in Scoold, a Q&A and knowledge-sharing platform, allows users with personal API tokens to access confidential replies to private questions. Users can exploit this issue when specific conditions are met, allowing them to read responses from queries in private spaces they do not have authorization to access. This occurs due to a failure in applying access controls in the API method that retrieves post replies. As a result, sensitive information may be exposed if an unauthorized user knows or can enumerate a private question identifier. The issue has been addressed in version 1.69.0, and teams using Scoold are advised to upgrade to ensure their private discussions remain confidential.

References