Is CVE-2026-42176 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-42176 being exploited in the wild.

How severe is CVE-2026-42176?

Medium severity, with a CVSS score of 6.7, published 8 May 2026.

Is there a fix for CVE-2026-42176?

A patch was published on 2026-04-20: Version 1.67.0 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-42176 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-42176?

Check whether you run Erudika Scoold at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-42176: Erudika Scoold privilege escalation via configuration overwrite

CVE-2026-42176 · Severity: medium · CVSS 6.7 · Published 2026-05-08

Scoold, a Q&A and knowledge-sharing platform, contains a vulnerability that allows an attacker to gain permanent administrator access. By exploiting a flaw in how the system validates security tokens, an attacker can modify the application's configuration file to add their own email address to the administrator list. While the change only takes effect after the application restarts, it provides a reliable way for an attacker to maintain control over the platform, potentially leading to the exposure of sensitive internal knowledge and unauthorized management of the system.

Technologies: Erudika Scoold. Vendors: Erudika.

Quick answers

Is CVE-2026-42176 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-42176 being exploited in the wild.
How severe is CVE-2026-42176?: Medium severity, with a CVSS score of 6.7, published 8 May 2026.
Which products and versions are affected?: Erudika Scoold < 1.67.0.
Is there a fix for CVE-2026-42176?: A patch was published on 2026-04-20: Version 1.67.0 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-42176 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-42176?: Check whether you run Erudika Scoold at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

Scoold prior to version 1.67.0 is vulnerable to a persistent privilege escalation flaw due to missing authentication/validation (CWE-306) in the `/api/config/set/admins` endpoint. An attacker can use a forged JWT (Bearer token) that lacks proper `jti` validation to authenticate as an administrator and modify the `scoold.admins` configuration value. The application writes this change directly to the configuration file. Although the `ADMINS` set is loaded into memory only at startup—meaning the exploit is not immediate—the attacker gains full administrative privileges once the Scoold service is restarted. This provides a durable persistence mechanism that survives session termination. The issue is fixed in version 1.67.0 by improving security checks in `ApiController`.

Affected products

Erudika Scoold < 1.67.0

Timeline

2026-04-20: patched: Version 1.67.0 released
2026-05-08: disclosed: Public advisory published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.