# CVE-2026-55842: Scoold CORS misconfiguration allows cross-site request forgery

Source: https://junglewise.ai/threats/cve-2026-55842-scoold-is-a-q-a-and-a-knowledge-sharing-platform-for-teams-prior  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-15. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-55842 · Severity: medium · CVSS 5.4 · Published 2026-10-15

Scoold is a Q&A and knowledge-sharing platform for teams. A misconfiguration in its API's Cross-Origin Resource Sharing (CORS) settings allows any website to make authenticated requests on behalf of logged-in users. An attacker can craft a malicious website that, when visited by a Scoold user, silently reads user data, questions, and configuration, or performs actions like posting or deleting content without the user's knowledge.

Technologies: [Erudika Scoold](https://junglewise.ai/threats/technologies/scoold). Vendors: [Erudika](https://junglewise.ai/threats/vendors/erudika).

## Quick answers

**Is CVE-2026-55842 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-55842 being exploited in the wild.

**How severe is CVE-2026-55842?** Medium severity, with a CVSS score of 5.4, published 15 October 2026.

**Which products and versions are affected?** Erudika Scoold prior to 1.69.1.

**Is there a fix for CVE-2026-55842?** Yes: fixed in 1.69.1. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-55842 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-55842?** Check whether you run Erudika Scoold at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 1.69.1

## Technical details

The apiCorsConfiguration() method combines addAllowedOriginPattern("*") with setAllowCredentials(true), causing Spring to echo back the requesting origin while permitting credential submission in cross-origin requests. This enables cross-site request forgery (CSRF) attacks against authenticated API endpoints without user interaction or CSRF tokens. Exploitation requires the victim to visit a malicious site while logged into Scoold.

## Affected products

- Erudika Scoold prior to 1.69.1

## Timeline

- 2026-10-15: disclosed

## References

- [https://github.com/Erudika/scoold/commit/6412441f656984c07af147b6ba2f2fc7906b2c5c](https://github.com/Erudika/scoold/commit/6412441f656984c07af147b6ba2f2fc7906b2c5c)
- [https://github.com/Erudika/scoold/releases/tag/1.69.1](https://github.com/Erudika/scoold/releases/tag/1.69.1)

## Related threats

- [Scoold authentication bypass in API configuration endpoints](https://junglewise.ai/threats/cve-2026-57183-scoold-is-a-q-a-and-a-knowledge-sharing-platform-for-teams-prior)
- [Erudika Scoold open redirect in authentication callback](https://junglewise.ai/threats/cve-2026-55840-scoold-is-a-q-a-and-a-knowledge-sharing-platform-for-teams-prior)
- [Erudika Scoold privilege escalation in private spaces](https://junglewise.ai/threats/cve-2026-54677-erudika-scoold-privilege-escalation-in-private-spaces)
- [Scoold API authorization bypass in question replies](https://junglewise.ai/threats/cve-2026-54676-scoold-api-authorization-bypass-in-question-replies)
- [Erudika Scoold privilege escalation via configuration overwrite](https://junglewise.ai/threats/cve-2026-42176-erudika-scoold-privilege-escalation-via-configuration-overwrite)