Scoold versions prior to 1.66.2 allow a logged‑in user with low privileges to overwrite an existing question by supplying that question’s public ID in the postId parameter of the POST /questions/ask endpoint. The flaw is caused by insufficient authorization checks when the client supplies the postId. This results in the attacker’s content being stored under the victim question object, corrupting the discussion thread and erasing the original question text.

The affected product is Erudika Scoold, a Q&A platform for teams. All releases before version 1.66.2 are vulnerable. The issue is present in every build earlier than the 1.66.2 update.

The CVSS score of 6.5 indicates a moderate severity. An EPSS score of less than 1% suggests a low likelihood of exploitation, and the vulnerability is not listed in the CISA KEV catalog. The exploitation requires an authenticated session, so any user with a valid account, even with low privileges, can trigger the flaw by submitting a malicious postId. No external unauthenticated attack vector is indicated.