What is CVE-2026-56877?

CVE-2026-56877 is a medium-severity vulnerability in Skillable Scorm Lab Launch Integration, classified under CWE-472. CVSS score: 6.3/10. Published 2026-07-13.

How severe is CVE-2026-56877?

Medium severity. CVSS v3 base score is 6.3 out of 10.

Vulnerability in Skillable Scorm Lab Launch Integration

CVE-2026-56877

The SCORM lab launch endpoint in Skillable (scorm.skillable.com) through 2026-07-13 does not validate the client-supplied userId parameter against the authenticated SCORM session token. An authenticated user can substitute arbitrary userId values to bypass per-user lab launch rate limits and consume other users' lab allocations, resulting in denial of service against targeted users' lab and exam access. Skillable was formerly named Learn on Demand Systems.

Published 2026-07-13 · last modified 2026-07-16.

CVSS v3 metric

CVSS v3 base score 6.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L.

EPSS exploit prediction

EPSS: 0.004 (31.5th percentile), scored 2026-10-12.

Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 32nd percentile — 31.5% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS over last 30 days · oldest: 0.004 · newest: 0.004 · change: 0.000

Affected products

Skillable Scorm Lab Launch Integration — versions 0

Weakness classification (CWE)

CWE-472

References

Frequently asked questions

What is CVE-2026-56877?: CVE-2026-56877 is a medium-severity vulnerability in Skillable Scorm Lab Launch Integration, classified under CWE-472. CVSS score: 6.3/10. Published 2026-07-13.
How severe is CVE-2026-56877?: Medium severity. CVSS v3 base score is 6.3 out of 10.