CVE-2026-63231: Three Learning Koollab LMS SQL injection in face-to-face runs update endpoint

CVE-2026-63231 · Severity: high · CVSS 8.1 · Published 2026-07-29

Koollab LMS, a cloud-based learning management system used for corporate training and assessments, contains a security flaw in its face-to-face training update feature. An authorized user, such as a student or instructor, could exploit this flaw to access the entire underlying database. This could lead to the theft of sensitive personal information, login credentials, and security tokens, potentially allowing the attacker to take over other user accounts, including those of administrators.

Technologies: Three Learning Koollab LMS. Vendors: Three Learning.

Quick answers

Is CVE-2026-63231 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-63231 being exploited in the wild.
How severe is CVE-2026-63231?
High severity, with a CVSS score of 8.1, published 29 July 2026.
Which products and versions are affected?
Three Learning Koollab LMS 5.3.2.
Is there a fix for CVE-2026-63231?
A patch was published on 2026-04-26: Vendor patched cloud instances Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-63231 attacked?
It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-63231?
Check whether you run Three Learning Koollab LMS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A post-authentication SQL injection vulnerability exists in Koollab LMS version 5.3.2 within the 'face-to-face runs update' endpoint. The flaw is rooted in insufficient sanitization of user-supplied input, allowing an authenticated attacker to perform error-based SQL injection. By leveraging an error-based SQL oracle, an attacker can exfiltrate sensitive data from the entire application database, including personally identifiable information (PII) and JSON Web Tokens (JWTs). These tokens can subsequently be used to facilitate account takeover. The vendor has patched all cloud-hosted (SaaS) instances, and no user action is required.

Affected products

  • Three Learning Koollab LMS 5.3.2

Timeline

  • 2026-04-14: disclosed: Vendor disclosure
  • 2026-04-26: patched: Vendor patched cloud instances
  • 2026-07-29: advisory: Public release of advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.