CVE-2026-109564

Low

Description

LearnHouse before 1.4.0 contains a missing authorization vulnerability in POST /api/v1/playgrounds/{uuid}/duplicate that skips the read-access and draft checks enforced by get_playground. Authenticated users with playground creation rights, such as Instructors, who know a RESTRICTED or unpublished playground UUID can copy its html_content and republish it publicly.

SeverityLow

CVSS3.1

Exploit probability—

ProductLearnHouse

PublishedOct 12, 2026

First seenOct 12, 2026

Weakness typeCWE-862Missing authorization

How to fix

Update

learnhouse LearnHouse1.4.0 or later

Patches

github.com/learnhouse/learnhouse/pull/1120
github.com/learnhouse/learnhouse/commit/9a1319185a596ea9b40651dbfd96f05195c0be37

Affected products

Product	Affected versions	Fixed in
learnhouse LearnHouse	v < 1.4.0	1.4.0

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.