{
  "affected": [
    {
      "affectedData": [
        {
          "product": "scoold",
          "vendor": "Erudika",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.66.2"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:erudika:scoold:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "8F1340F2-5D49-4F87-B3DB-2187E5842588",
              "versionEndExcluding": "1.66.2",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Scoold is a Q\u0026A and a knowledge sharing platform for teams. Prior to 1.66.2, an authenticated authorization flaw in Scoold allows any logged-in, low-privilege user to overwrite another user\u0027s existing question by supplying that question\u0027s public ID as the postId parameter to POST /questions/ask. Because question IDs are exposed in normal question URLs, a low-privilege attacker can take a victim question ID from a public page and cause attacker-controlled content to be stored under that existing question object. This causes direct integrity loss of user-generated content and corrupts the integrity of the existing discussion thread. This vulnerability is fixed in 1.66.2."
    },
    {
      "lang": "es",
      "value": "Scoold es una plataforma de preguntas y respuestas y de intercambio de conocimientos para equipos. Antes de la versi\u00f3n 1.66.2, un fallo de autorizaci\u00f3n autenticado en Scoold permite a cualquier usuario con sesi\u00f3n iniciada y de bajo privilegio sobrescribir la pregunta existente de otro usuario proporcionando el ID p\u00fablico de esa pregunta como el par\u00e1metro postId a POST /questions/ask. Debido a que los ID de las preguntas est\u00e1n expuestos en las URL normales de las preguntas, un atacante de bajo privilegio puede tomar el ID de una pregunta de la v\u00edctima de una p\u00e1gina p\u00fablica y hacer que el contenido controlado por el atacante se almacene bajo ese objeto de pregunta existente. Esto causa una p\u00e9rdida directa de integridad del contenido generado por el usuario y corrompe la integridad del hilo de discusi\u00f3n existente. Esta vulnerabilidad est\u00e1 corregida en la versi\u00f3n 1.66.2."
    }
  ],
  "id": "CVE-2026-39354",
  "lastModified": "2026-07-24T21:10:00.143",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 6.5,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "NONE",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 3.6,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-39354",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-04-09T15:04:47.366387Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-04-07T19:16:46.357",
  "references": [
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ],
      "url": "https://github.com/Erudika/scoold/security/advisories/GHSA-768r-cv9p-wrcm"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ],
      "url": "https://github.com/Erudika/scoold/security/advisories/GHSA-768r-cv9p-wrcm"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-639"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}