The vulnerability lies in the PolarLearn group chat WebSocket, which can be accessed without authentication. An unauthenticated client can subscribe to any group chat by providing its UUID and can also post messages to that group. These messages are accepted by the server and stored in the chatContent field, making the issue a data integrity and potential misinformation problem rather than just a visual spam issue. The weakness maps to CWE-285 (Improper Authentication) and CWE-306 (Missing Authentication for Critical Function).

polarnl PolarLearn versions 0‑PRERELEASE‑16 and earlier are affected.

The CVSS score of 10 indicates critical severity, while the EPSS score of less than 1% suggests that zero‑day exploitation is currently unlikely but still a risk. The vulnerability is not listed in the CISA KEV catalog. The attack vector is remote: any client with network access to wss://polarlearn.nl/api/v1/ws can open a WebSocket connection, provide a group UUID to subscribe, and then send arbitrary messages. No credentials are required, and the server stores those messages, resulting in persistent data tampering.