PlayEdu up to version 2.3 contains a missing authorization flaw in the CourseController. The flaw allows any authenticated student to retrieve details and download attachments for courses belonging to other departments. By simply omitting the department visibility check, a student can enumerate course and attachment identifiers through the existing endpoints and expose the structure, metadata, and files of courses that should be hidden. This vulnerability is classified as CWE‑639, indicating that sensitive information can be accessed by users lacking proper authorizations.

Products: PlayEdu, version 2.3. The CVE specifically targets the 2.3 release; versions prior or subsequent to 2.3 are not documented as affected in the current advisory.

The CVSS score of 5.3 indicates a moderate severity. Because the EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, the likelihood of exploitation is uncertain but not negligible. The attack vector requires the attacker to be an authenticated student user, so any user with valid credentials could launch the exploit by accessing publicly exposed CourseController endpoints and systematically iterating numerical identifiers to enumerate course and attachment resources. If successful, the attacker gains unauthorized visibility into cross‑department course materials and potentially sensitive attachments.