CVE-2026-108921: Missing Authentication in KusalkaSilva Learning-Management-System

This vulnerability in KusalkaSilva Learning-Management-System up to commit ffeb873f8803f1e9664384ff75000c7da45466d2 affects the mysql_query function in remove_announcements.php. Manipulating the ID argument leads to missing authentication on state-changing endpoints, enabling remote attackers to perform unauthorized actions. The product's rolling release model prevents precise version identification. The issue was reported early to the project, but no fix or response has been provided. Public exploit code exists, though no active exploitation is confirmed.

The vulnerability allows remote attackers to bypass authentication controls on a state-changing endpoint, potentially enabling unauthorized modification or removal of announcements. This could lead to unauthorized changes within the Learning-Management-System, impacting integrity and trustworthiness of announcements or related data. The CVSS 4.0 score of 6.9 reflects a medium severity with network attack vector, no privileges or user interaction required, and low to limited impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or issued a fix, users should monitor official channels for updates. Until a fix is available, restrict access to the affected endpoint if possible and consider additional access controls or network-level protections to limit exposure.