CVE-2026-120199

EUVD-2026-114720
LearnHouse before 1.1.1 contains a missing authorization vulnerability in the assignment API that allows authenticated users to read other users' grades and submissions. Attackers can supply another user_id to the submissions grade endpoint or query submission read functions to view other students' work, grades and instructor feedback.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
VulnCheckCNA
4.3 MEDIUM
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources (CNA/ADP records, vendor advisories, Enginsight analysis).
VendorProductVersionSource
learnhouselearnhouse
𝑥
< 1.1.1
CNA
Common Weakness Enumeration
References
https://github.com/learnhouse/learnhouse
https://github.com/learnhouse/learnhouse/blob/1.1.0/apps/api/src/services/courses/activities/assignments.py#L1673
https://github.com/learnhouse/learnhouse/commit/844a8a7787f0c42d466be604aaf47d296748b1b3
https://github.com/learnhouse/learnhouse/issues/1184
https://github.com/learnhouse/learnhouse/pull/1187
https://www.vulncheck.com/advisories/learnhouse-before-1.1.1-missing-authorization-via-assignment-submissions-api