CyberRota Analysis
AI-GeneratedLearnHouse versions prior to 1.4.0 are vulnerable due to a missing authorization check in the duplication endpoint, allowing authenticated users with playground creation rights to bypass access controls. This flaw enables users, such as Instructors, to replicate and publicly publish restricted or unpublished playground content if they possess the UUID. Organizations using LearnHouse should prioritize patching this vulnerability to prevent unauthorized content exposure.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
LearnHouse before 1.4.0 contains a missing authorization vulnerability in POST /api/v1/playgrounds/{uuid}/duplicate that skips the read-access and draft checks enforced by get_playground. Authenticated users with playground creation rights, such as Instructors, who know a RESTRICTED or unpublished playground UUID can copy its html_content and republish it publicly.