The vulnerability is a missing authorization check in the duplicate endpoint of the API. Normal access control is performed by get_playground to enforce read‑access and draft status; this logic is bypassed when the POST /api/v1/playgrounds/{uuid}/duplicate is called. An authenticated user with playground‑creation rights can therefore duplicate a playground that is marked restricted or not yet published and re‑publish that content with no restriction.

This flaw exists in all LearnHouse releases prior to 1.4.0, which deploy the duplicate endpoint with the security oversight. The product is LearnHouse, an online learning platform. Anyone running a pre‑1.4.0 instance is vulnerable, regardless of the specific patch level within that range.

The CVSS score of 2.3 indicates a low impact in the CVSS model. Because the exploit requires an authenticated role that already has creation permissions and knowledge of a restricted playground’s UUID, the wall time to exploit is minimal once the prerequisite is met. No exploit probability score is currently available, and the vulnerability is not listed in the CISA KEV catalog. Nonetheless, the ability to expose confidential or unpublished content poses a significant business risk.