CVE-2026-25126

PolarLearn is a free and open-source learning program. Prior to version 0-PRERELEASE-15, the vote API route "POST /api/v1/forum/vote" trusts the JSON body’s "direction" value without runtime validation. TypeScript types are not enforced at runtime, so an attacker can send arbitrary strings e.g.,...