An improper access control flaw in Koollab LMS allows an attacker to terminate legitimate user sessions by exploiting the login kickout endpoint. The vulnerability is triggered by supplying an email address, enabling an unauthenticated attacker to forcibly disconnect any user and cause a denial of service for that user. The weakness is a classic example of CWE‑284, where relevant authorization checks are missing, leading to a loss of service availability.

Three Learning’s Koollab LMS product is impacted. No specific product versions are listed in the available data; the vulnerability applies to all current releases of the LMS until a patch is issued.

The CVSS score of 3.7 indicates low severity, and the EPSS score of less than 1 % suggests a very low probability of widespread exploitation at present. The vulnerability is classified as not listed in CISA KEV. Because the attack vector is unauthenticated, an attacker requires no credentials; however, the attacker must know or guess a target email address to cause the session termination. The overall risk remains low but persistent until mitigated.