The vulnerability resides in Scoold’s CORS configuration where the server reflects any origin while allowing credentials. A user authenticated to Scoold can be tricked into visiting a malicious site, which then can issue API requests carrying that user’s session cookies. The attacker could read user data, questions, and configuration, and trigger privileged actions on the user’s behalf. The weakness hinges on improper origin validation and the misuse of credentialed CORS.

This flaw affects Erudika’s Scoold platform, specifically all deployed versions prior to 1.69.1. The upstream source indicates the issue existed in the apiCorsConfiguration method before the 1.69.1 release. Users of older Scoold deployments are at risk.

The CVSS score of 5.4 reflects a moderate severity; the EPSS score of less than 1% suggests very low probability of current exploitation. The flaw is not listed in CISA’s KEV catalog. The likely attack vector is a browser-based attack where a logged‑in Scoold user visits a malicious domain. Exploitation requires only that the victim be authenticated and that the web browser accepts cross‑origin requests with credentials, conditions commonly satisfied in normal use. The vulnerability can be leveraged to perform data exfiltration or unauthorized modifications of user content.