Scoold’s /api/config/set/admins endpoint allowed an attacker to overwrite the configuration setting that lists administrator email addresses. By forging a Bearer JWT that the application mistakenly accepted as an admin token, the attacker could write an arbitrary email into the scoold.admins configuration key. The change is not applied until the application restarts, giving the attacker a reliable persistence mechanism: after a restart the account is granted full administrative access to the web interface. This flaw is rooted in missing validation of the JWT’s jti claim, which constitutes an authentication bypass weakness (CWE‑306).

Erudika Scoold versions prior to 1.67.0 are affected. The issue was fixed in the 1.67.0 release. Any deployment using an older build with the /api/config/set/admins endpoint exposed remains vulnerable.

The CVSS score of 6.7 indicates a moderate severity, yet the persistence path dramatically increases long‑term impact. Exploitation requires remote access to the vulnerable API endpoint and the ability to forge a JWT; no specialized hardware is needed. EPSS data is currently unavailable, and the vulnerability is not listed in the CISA KEV catalog, but the attack vector and persistence make it a high‑risk issue for organizational security.