What is CVE-2026-63236?

CVE-2026-63236 is a low-severity vulnerability in Three Learning Koollab Lms, classified under Improper Access Control. CVSS score: 3.7/10. Published 2026-07-29.

How severe is CVE-2026-63236?

Low severity. CVSS v3 base score is 3.7 out of 10.

Vulnerability in Three Learning Koollab Lms

CVE-2026-63236

An improper access control vulnerability in Koollab LMS allowed an unauthenticated attacker to read another user's name, internal identifier, scores, lesson status, lesson position, and cached lesson state via the SCORM API endpoint.

CVSS v3 metric

CVSS v3 base score 3.7 (Low). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N.

Affected products

Three Learning Koollab Lms — versions 5.3.2

Weakness classification (CWE)

CWE-284 — Improper Access Control

References

5f57b9bf-260d-4433-bf07-b6a79e9bb7d4

Frequently asked questions

What is CVE-2026-63236?: CVE-2026-63236 is a low-severity vulnerability in Three Learning Koollab Lms, classified under Improper Access Control. CVSS score: 3.7/10. Published 2026-07-29.
How severe is CVE-2026-63236?: Low severity. CVSS v3 base score is 3.7 out of 10.