Is CVE-2026-97864 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-97864 being exploited in the wild.

How severe is CVE-2026-97864?

Medium severity, with a CVSS score of 5.3, published 25 September 2026.

Which products and versions are affected?

GibbonEdu Gibbon up to 30.0.01.

Is there a fix for CVE-2026-97864?

A patch was published on 2026-09-25: version 31.0.00, patch 07e719368eae8dfb4e22e19424ceab6074164ebc Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-97864 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-97864?

Check whether you run GibbonEdu Gibbon at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-97864: GibbonEdu Gibbon authentication bypass in Unit Planner

CVE-2026-97864 · Severity: medium · CVSS 5.3 · Published 2026-09-25

GibbonEdu Gibbon is an open-source school management system used to organize curricula and lesson planning. A missing authentication check in the Unit Planner component allows an attacker to bypass security controls and manipulate unit blocks remotely without valid credentials, potentially exposing or altering educational content.

Technologies: GibbonEdu Gibbon. Vendors: GibbonEdu.

Quick answers

Is CVE-2026-97864 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-97864 being exploited in the wild.
How severe is CVE-2026-97864?: Medium severity, with a CVSS score of 5.3, published 25 September 2026.
Which products and versions are affected?: GibbonEdu Gibbon up to 30.0.01.
Is there a fix for CVE-2026-97864?: A patch was published on 2026-09-25: version 31.0.00, patch 07e719368eae8dfb4e22e19424ceab6074164ebc Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-97864 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-97864?: Check whether you run GibbonEdu Gibbon at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The makeBlock function in modules/Planner/units_add_blockAjax.php lacks proper authentication validation on the gibbonUnitBlockID and mode parameters, allowing unauthenticated remote requests. An attacker can manipulate these arguments to perform unauthorized actions on unit planner data without credentials. A patch was released in version 31.0.00.

Affected products

GibbonEdu Gibbon up to 30.0.01

Timeline

2026-09-25: disclosed
2026-09-25: patched: version 31.0.00, patch 07e719368eae8dfb4e22e19424ceab6074164ebc

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.