CVE-2026-111603
PlayEdu through 2.3 Missing Authorization via Student CourseController Endpoints
- State
- Published
- Severity
- 5.3 Medium
- Published
- Oct 16, 2026
- Updated
- Oct 23, 2026
- Reserved
- Oct 16, 2026
Description
PlayEdu through 2.3 contains a missing authorization vulnerability in the CourseController that allows authenticated students to access department-restricted courses by omitting the department visibility check. Attackers can enumerate sequential course and attachment IDs via the course details and attachment download endpoints to obtain course structure and attachment files from other departments.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 5.3 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 4.3 Medium | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N | VulnCheck |
Weaknesses
- CWE-639 Authorization Bypass Through User-Controlled Key
Affected Products
| Product | Versions |
|---|---|
PlayEduPlayEdu |
|
References
- https://hackmd.io/@hieuPenguinnn/playedu-course-attachment-cross-department-authzthird-party-advisory
- https://github.com/PlayEdu/PlayEdu/blob/2.3/playedu-api/playedu-api/src/main/java/xyz/playedu/api/controller/frontend/CourseController.java#L57-L132technical-description
- https://github.com/PlayEdu/PlayEduproduct
- VulnCheck Advisory: PlayEdu through 2.3 Missing Authorization via Student CourseController Endpointsthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.