The vulnerability is an IDOR that allows a logged‑in, low‑privilege user to delete any other user’s feedback post by specifying its identifier in a POST request to /feedback/{id}/delete. Because authentication is enforced but ownership checks are missing, the attacker can remove content and potentially disrupt knowledge sharing within the platform, undermining the integrity and availability of user contributions.

Erudika’s Scoold platform, versions prior to 1.66.1, is affected. The issue was fixed in release 1.66.1.

With a CVSS score of 6.5, the flaw is classified as Medium severity. Exploitation requires authenticated access; any standard user can delete content when they know the feedback ID. EPSS score is unavailable and KEV catalog shows no listing. The attack vector is inferred to be an internal authenticated POST request where the attacker supplies the target’s feedback identifier.