Scoold, a team knowledge‑sharing platform, contained a flaw in the checkApiAuth function that allowed any JWT signed with the application or parameter secret key to be accepted as an administrative token on /api/config and /api/stats. The check ran even when the API was disabled, and a forged token was mapped to a hard‑coded admin user. As a result an attacker who knew either signing secret could read all sensitive configuration data and server logs and invoke privileged configuration operations, while ordinary session tokens were insufficient.

Vulnerable systems are installations of Erudika:scoold before the 1.69.1 release. Any instance that has not applied the security update and still relies on the default hard‑coded admin mapping is affected. The bug impacts the API endpoints /api/config and /api/stats that expose internal settings and log files.

The CVSS score of 6.1 indicates a moderate severity. The EPSS score of less than 1% shows a low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires knowledge of the app_secret_key or para_secret_key; once the secret is known, an attacker can craft a signed JWT and obtain administrative access to configuration and logs, bypassing any deployment of scoold.api_enabled or standard authentication.