The flaw is in the makeBlock function within modules/Planner/units_add_blockAjax.php. An attacker can supply manipulated values for the gibbonUnitBlockID or mode parameters and the function proceeds without verifying that the requester is authenticated. This omission permits attackers to create, modify, or delete unit planner blocks by sending crafted requests, potentially altering the educational schedule or erasing planned content. The vulnerability is classified as an authentication bypass, a serious security weakness that affects data integrity and confidentiality of the planning module.

The issue exists in GibbonEdu’s Gibbon software up through version 30.0.01 and earlier. Upgrading to 31.0.00 or later, which includes the patch identified by commit 07e719368eae8dfb4e22e19424ceab6074164ebc, eliminates the flaw.

The CVSS score of 6.9 indicates moderate severity. The exploit can be carried out remotely, as the vulnerable endpoint is exposed via the web interface. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog, implying no confirmed active exploitation at the time of this assessment. Nonetheless, the remote nature and authentication bypass give attackers the ability to compromise Planner data, so the risk remains significant for institutions that rely on this feature.