Executive brief
Scoold is a Q&A and knowledge-sharing platform used by teams to organize and discuss information. Users who hold API tokens can bypass access controls to retrieve confidential replies to questions in private spaces they should not be able to access, exposing sensitive team discussions. This affects installations with API access enabled before version 1.69.0.
Technical details
The vulnerability is an authorization bypass in the GET /api/posts/{id}/answers endpoint of Scoold's ApiController. The endpoint fails to call the canAccessSpace() authorization check before returning reply data, allowing a token-holding attacker to enumerate and access private question identifiers and retrieve their answers without proper access verification. The attack requires the victim to have a valid personal API token and requires both scoold.api_user_access_enabled and scoold.api_enabled configuration flags to be true. An attacker can disclose private team or project discussions by iterating through question IDs. The vulnerability is fixed in version 1.69.0 via commit 6976afb.
Affected products
- Erudika Scoold before 1.69.0
Timeline
- 2026-09-17: disclosed
- 2026-06-12: patched: Fixed in version 1.69.0