PlayEdu through 2.3 Missing Authorization via Student CourseController Endpoints
PlayEdu through 2.3 contains a missing authorization vulnerability in the CourseController that allows authenticated students to access department-restricted courses by omitting the department visibility check. Attackers can enumerate sequential course and attachment IDs via the course details and attachment download endpoints to obtain course structure and attachment files from other departments.
CVE-2026-111603
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-111603
PlayEdu
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"repo": "https://github.com/PlayEdu/PlayEdu",
"vendor": "PlayEdu",
"product": "PlayEdu",
"versions": [
{
"status": "affected",
"version": "0",
"versionType": "custom",
"lessThanOrEqual": "2.3"
}
],
"packageURL": "pkg:github/PlayEdu/PlayEdu",
"defaultStatus": "unaffected"
}
]- Related CVEs
- CVE-2026-111603
Source reference:
/cveMetadata/cveId
Publisher severity
medium
Source reference: /containers/cna/metrics
- Event
- #53104 · Revision 1
- Added to Heist Feed
- Publisher date