# CVE-2026-108921: KusalkaSilva Learning-Management-System authentication bypass in remove_announcements.php

Source: https://junglewise.ai/threats/cve-2026-108921-a-vulnerability-was-detected-in-kusalkasilva-learning-management  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-12. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-108921 · Severity: high · CVSS 7.3 · Published 2026-10-12

A Learning Management System used by universities lacks authentication checks in its announcement removal endpoint. An attacker can delete or modify announcements by manipulating request parameters without logging in, disrupting institutional communications and potentially enabling further attacks.

Technologies: [Kusalkasilva Learning-Management-System](https://junglewise.ai/threats/technologies/kusalkasilva-learning-management-system). Vendors: [Kusalkasilva](https://junglewise.ai/threats/vendors/kusalkasilva).

## Quick answers

**Is CVE-2026-108921 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-108921 being exploited in the wild.

**How severe is CVE-2026-108921?** High severity, with a CVSS score of 7.3, published 12 October 2026.

**Which products and versions are affected?** Kusalkasilva Learning-Management-System up to ffeb873f8803f1e9664384ff75000c7da45466d2.

**Is there a fix for CVE-2026-108921?** No fixed version is recorded yet. Add session validation and CSRF token checks to all state-changing endpoints, particularly remove_announcements.php, to ensure only authenticated users can modify data. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-108921 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-108921?** Check whether you run Kusalkasilva Learning-Management-System at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix


Add session validation and CSRF token checks to all state-changing endpoints, particularly remove_announcements.php, to ensure only authenticated users can modify data.

## Technical details

The vulnerability is a missing authentication check in the remove_announcements.php component's mysql_query function, affecting state-changing endpoints. An unauthenticated remote attacker can manipulate the ID argument to delete or modify announcements without a valid session or CSRF token, gaining unauthorized administrative capabilities.

## Affected products

- KusalkaSilva Learning-Management-System up to ffeb873f8803f1e9664384ff75000c7da45466d2

## Timeline

- 2026-10-12: disclosed
- other: Exploit made public

## References

- [https://github.com/KusalkaSilva/Learning-Management-System/](https://github.com/KusalkaSilva/Learning-Management-System/)
- [https://github.com/KusalkaSilva/Learning-Management-System/issues/5](https://github.com/KusalkaSilva/Learning-Management-System/issues/5)

## Related threats

- [KusalkaSilva Learning-Management-System unrestricted file upload in upload_save.php](https://junglewise.ai/threats/cve-2026-108922-a-flaw-has-been-found-in-kusalkasilva-learning-management-system)
- [Kusalkasilva Learning-Management-System SQL injection in search_class.php](https://junglewise.ai/threats/cve-2026-105921-a-vulnerability-was-identified-in-kusalkasilva-learning)
- [Kusalkasilva Learning-Management-System SQL injection in student registration](https://junglewise.ai/threats/cve-2026-105920-a-vulnerability-was-determined-in-kusalkasilva-learning)
- [Kusalkasilva Learning-Management-System SQL injection in administrator login](https://junglewise.ai/threats/cve-2026-105919-a-vulnerability-was-found-in-kusalkasilva-learning-management)
- [Kusalkasilva Learning-Management-System SQL injection in login endpoint](https://junglewise.ai/threats/cve-2026-105918-a-vulnerability-has-been-found-in-kusalkasilva-learning)