Scoold versions before 1.69.0 allow users who possess a personal API token to retrieve the content of replies to questions that are stored in private spaces. The API endpoint GET /api/posts/{id}/answers omits a permission check, so it returns the bodies of private replies while the corresponding question endpoint correctly denies access. This flaw permits an attacker to disclose confidential discussion content that should be restricted to space members.

The affected product is Erudika Scoold. Versions prior to 1.69.0 are impacted. Users of any version older than 1.69.0 that is configured with scoold.api_user_access_enabled and scoold.api_enabled can exploit the vulnerability if they possess a valid personal API token and know or can enumerate the identifier of a private question.

The vulnerability has a CVSS score of 6.5, indicating a moderate severity for disclosure of private data. The EPSS score is less than 1%, suggesting low exploitation probability, and it is not listed in the CISA KEV catalog. Exploitation requires a personal API token and knowledge or enumeration of a private question identifier; once those conditions are met, the attacker can simply issue a GET request to the answers endpoint and receive private reply content.