CVE-2026-54677 Scoold: Authenticated user can post replies and comments to private-space questions without space membership

Scoold is a Q&A and a knowledge sharing platform for teams. Prior to 1.69.0, authenticated users who are not members of a private space can create content in questions belonging to that space because src/main/java/com/erudika/scoold/controllers/QuestionController.java in QuestionController.reply...

PT-2026-95023

Name of the Vulnerable Software and Affected Versions Scoold versions prior to 1.69.0 Description Authenticated users who are not members of a private space can create content in questions belonging to that space. This occurs because the reply function in QuestionController.java and the createAja...