Auth bypass in Markusproject Markus
CVE-2026-24900
MarkUs is a web application for the submission and grading of student assignments. Prior to 2.9.1, the courses/<:course_id>/assignments/<:assignment_id>/submissions/html_content accepted a select_file_id parameter to serve SubmissionFile objects containing a record of files submitted by students. This parameter was not correctly scoped to the requesting user, allowing users access arbitrary submission file contents by id. This vulnerability is fixed in 2.9.1.
Vulnerability class: IDOR (Insecure Direct Object Reference)
EPSS: 0.003 (16.6th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N.
Affected products
- Markusproject Markus — versions < 2.9.1
Weakness classification (CWE)
References
- security-advisories@github.com (x_refsource_CONFIRM, Vendor Advisory)
- security-advisories@github.com (Patch, x_refsource_MISC)
- security-advisories@github.com (Product, x_refsource_MISC, Release Notes)
Frequently asked questions
- What is CVE-2026-24900?
- CVE-2026-24900 is a medium-severity vulnerability in Markusproject Markus, classified under Authorization Bypass Through User-Controlled Key. CVSS score: 6.5/10. Published 2026-02-09.
- How severe is CVE-2026-24900?
- Medium severity. CVSS v3 base score is 6.5 out of 10.