LearnHouse versions prior to 1.1.1 expose a missing authorization check in the assignment API that allows an authenticated user to request another user_id in the submissions grade endpoint or read functions and thus view other students’ grades, instructor feedback, and submitted work. The impact is a breach of confidentiality for all individuals whose academic work and performance data become visible to others who are not authorized to see it, potentially compromising academic integrity.

Any deployment of LearnHouse running a version before 1.1.1 is affected, regardless of the specific edition. The vulnerability resides in the assignments service of the LearnHouse API and affects all installations that have not updated to the 1.1.1 release or applied the commit that fixes the authorization logic.

The CVSS score of 5.3 indicates moderate severity; the flaw requires an authenticated user and does not involve escalation or network exploitation. The EPSS score is not available, so the precise probability of active exploitation is unknown, but the presence of public advisories suggests that attackers who are already inside the system could abuse the flaw. The vulnerability has not yet been listed in the CISA KEV catalog, yet any organization using a pre‑1.1.1 LearnHouse instance should treat it as immediately exploitable by any authenticated user within the platform.