The vulnerability in Koollab LMS allows an authenticated attacker to execute a post‑authentication error‑based SQL injection against the face‑to‑face runs update endpoint. By injecting malicious SQL statements, the attacker can read the entire application database, including user credentials and valid JSON Web Tokens, enabling account takeover. The weakness is a classic SQL injection (CWE‑89) that compromises confidentiality, integrity, and availability of user accounts.

Three Learning’s Koollab LMS is affected. No specific version information was supplied, so all current releases of the LMS should be considered vulnerable until an official update is confirmed.

The CVSS score of 8.1 indicates a high severity, and although the EPSS score is less than 1%, the vulnerability remains exploitable by anyone with legitimate authentication to the LMS. Since the vulnerability is not listed in CISA’s KEV catalog, it has not yet been reported as a known exploited vulnerability, but the potential for data breach and unauthorized account access is clear. An attacker must authenticate to the LMS, but once authenticated can use the vulnerable endpoint to pull all data and JWT tokens, making the risk significant for any organization that allows user logins to the platform.