A business logic flaw in Koollab LMS allows an authenticated learner to mark a lesson as completed via the SCORM commit endpoint, even when the lesson material was never viewed. This enables manipulation of training records, undermining the integrity of completion data. The vulnerability highlights an authorization weakness, identified as CWE-639, where the system incorrectly trusts the learner as having finished the lesson.

The affected product is Three Learning’s Koollab LMS. No specific version numbers are listed, so all deployments of this LMS remain potentially vulnerable until further information is released.

The CVSS score of 4.3 rates the flaw as moderate, and the EPSS score of less than 1% indicates a low likelihood of exploitation in the wild. It is not listed in CISA’s Known Exploited Vulnerabilities catalog. The attack requires an authenticated user with access to the SCORM endpoint; the exploitable condition is the lack of validation that the lesson content has been viewed before allowing a completion status change.