CVE-2026-56877

The SCORM lab launch endpoint in Skillable scorm.skillable.com through 2026-07-13 does not validate the client-supplied userId parameter against the authenticated SCORM session token. An authenticated user can substitute arbitrary userId values to bypass per-user lab launch rate limits and consum...

CVE-2026-56877: External Control of Assumed-Immutable Web Parameter

The SCORM lab launch endpoint in Skillable scorm.skillable.com through 2026-07-13 does not validate the client-supplied userId parameter against the authenticated SCORM session token. An authenticated user can substitute arbitrary userId values to bypass per-user lab launch rate limits and consum...

PT-2026-57819

Name of the Vulnerable Software and Affected Versions Skillable affected versions not specified Description A flaw in the lab platform allows for the forgery of a client-supplied identifier to bypass per-user lab launch limits. By modifying the userId variable provided by the browser, an attacker...