CVE-2026-63240

An information disclosure vulnerability in Koollab LMS allowed an authenticated learner to obtain correct quiz answers from the course status endpoint without completing the assessment legitimately, compromising the integrity of assessments.

Score

CVSS 3.1 4.3 Medium

Status

Deferred - 5f57b9bf-260d-4433-bf07-b6a79e9bb7d4

Published

2026-07-29

Last modified

2026-10-23

Weaknesses

CWE-200

Affected products

• Koollab Lms (Three Learning)

References

• https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2026-094/