What is CVE-2026-63241?

CVE-2026-63241 is a low-severity vulnerability in Three Learning Koollab Lms, classified under Authorization Bypass Through User-Controlled Key. CVSS score: 3.1/10. Published 2026-07-29.

How severe is CVE-2026-63241?

Low severity. CVSS v3 base score is 3.1 out of 10.

Auth bypass in Three Learning Koollab Lms

CVE-2026-63241

An insecure direct object reference vulnerability in Koollab LMS allowed an authenticated user to query the course completion progress of any other user without authorisation, disclosing private learning progress information.

Vulnerability class: IDOR (Insecure Direct Object Reference)

CVSS v3 metric

CVSS v3 base score 3.1 (Low). Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N.

Affected products

Three Learning Koollab Lms — versions 5.3.2

Weakness classification (CWE)

CWE-639 — Authorization Bypass Through User-Controlled Key

References

5f57b9bf-260d-4433-bf07-b6a79e9bb7d4

Frequently asked questions

What is CVE-2026-63241?: CVE-2026-63241 is a low-severity vulnerability in Three Learning Koollab Lms, classified under Authorization Bypass Through User-Controlled Key. CVSS score: 3.1/10. Published 2026-07-29.
How severe is CVE-2026-63241?: Low severity. CVSS v3 base score is 3.1 out of 10.