What is CVE-2026-56877?

CVE-2026-56877 is a medium-severity vulnerability in Skillable Scorm Lab Launch Integration, classified under CWE-472. CVSS score: 6.3/10. Published 2026-07-13.

How severe is CVE-2026-56877?

Medium severity. CVSS v3 base score is 6.3 out of 10.

Vulnerability in Skillable Scorm Lab Launch Integration

CVE-2026-56877

The SCORM lab launch endpoint in Skillable (scorm.skillable.com) through 2026-07-13 does not validate the client-supplied userId parameter against the authenticated SCORM session token. An authenticated user can substitute arbitrary userId values to bypass per-user lab launch rate limits and consume other users' lab allocations, resulting in denial of service against targeted users' lab and exam access. Skillable was formerly named Learn on Demand Systems.

EPSS: 0.004 (32.3th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 6.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L.

Affected products

Skillable Scorm Lab Launch Integration — versions 0

Weakness classification (CWE)

CWE-472

References

Frequently asked questions

What is CVE-2026-56877?: CVE-2026-56877 is a medium-severity vulnerability in Skillable Scorm Lab Launch Integration, classified under CWE-472. CVSS score: 6.3/10. Published 2026-07-13.
How severe is CVE-2026-56877?: Medium severity. CVSS v3 base score is 6.3 out of 10.