CVE-2026-120199

Medium

Description

LearnHouse before 1.1.1 contains a missing authorization vulnerability in the assignment API that allows authenticated users to read other users' grades and submissions. Attackers can supply another user_id to the submissions grade endpoint or query submission read functions to view other students' work, grades and instructor feedback.

SeverityMedium

CVSS4.3

Exploit probability—

ProductLearnhouse

PublishedOct 31, 2026

First seenNov 4, 2026

Weakness typeCWE-639Authorization bypass through user-controlled key

How to fix

Update

learnhouse learnhouse1.1.1 or later

Patches

github.com/learnhouse/learnhouse/commit/844a8a7787f0c42d466be604aaf47d296748b1b3
github.com/learnhouse/learnhouse/pull/1187

Affected products

Product	Affected versions	Fixed in
learnhouse learnhouse	v < 1.1.1	1.1.1

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.