Executive brief
Erudika Scoold is a Q&A and knowledge-sharing platform used by teams to collaborate. A security flaw in the feedback system allows any registered user to delete feedback posts created by other users. This could lead to the unauthorized removal of important team suggestions or internal discussions, impacting the integrity of the platform's data.
Technical details
An Insecure Direct Object Reference (IDOR) vulnerability exists in Scoold's feedback deletion handler. The endpoint `POST /feedback/{id}/delete` in `FeedbackController.java` verifies that a user is authenticated but fails to perform an authorization check to ensure the user owns the feedback item or possesses administrative privileges. An attacker with low-level privileges can provide an arbitrary feedback ID to the endpoint to delete content belonging to other users. This issue is addressed in version 1.66.1 by implementing proper ownership and role-based access control checks before processing deletion requests.
Affected products
- Erudika Scoold < 1.66.1
Timeline
- 2026-03-30: advisory: GitHub Security Advisory published
- 2026-03-31: patched: Version 1.66.1 released
- 2026-04-02: disclosed: CVE-2026-34832 published