CVE-2026-24900

Katalog CVE

CVSS 6.5 · Medium EPSS 0,29%

Kerentanan Authorization Bypass Through User-Controlled Key pada markusproject markus. Skor CVSS 3.1 6.5 (Medium) menurut github.com.

Deskripsi (NVD)

MarkUs is a web application for the submission and grading of student assignments. Prior to 2.9.1, the courses/<:course_id>/assignments/<:assignment_id>/submissions/html_content accepted a select_file_id parameter to serve SubmissionFile objects containing a record of files submitted by students. This parameter was not correctly scoped to the requesting user, allowing users access arbitrary submission file contents by id. This vulnerability is fixed in 2.9.1.

Rincian

Terbit di NVD

9 Februari 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

6.5 (Medium), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-639: Authorization Bypass Through User-Controlled Key

EPSS (30 hari)

0,29% peluang dieksploitasi; lebih tinggi dari 20,1% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/MarkUsProject/Markus/security/advisories/GHSA-56gh-8hmq-7q88 advisory vendor
• https://github.com/MarkUsProject/Markus/commit/7daed9fd2d44932223798d997b55094a3bff104b patch
• https://github.com/MarkUsProject/Markus/releases/tag/v2.9.1 product · release notes