Erudika's Scoold platform, a knowledge-sharing and Q&A tool for teams, contained an authorization flaw identified as CVE-2026-34832 (CWE-639). This vulnerability exists in versions prior to 1.66.1 and involves the feedback deletion endpoint (POST /feedback/{id}/delete). While the endpoint correctly enforces that the requester is authenticated, it fails to verify whether the authenticated user owns the feedback post or has sufficient privileges (such as moderator or admin rights) to delete it. Consequently, any logged-in user, regardless of privilege level, can delete feedback posts submitted by other users simply by submitting the target post's ID. This leads to unauthorized modification of data, specifically the deletion of user-generated content, impacting data integrity. The vulnerability does not affect confidentiality or availability directly and does not require user interaction beyond authentication. The flaw was confirmed by successfully deleting another user's feedback using a non-privileged account. The issue was addressed and patched in Scoold version 1.66.1. The CVSS v3.1 base score is 6.5, reflecting a medium severity with network attack vector, low attack complexity, and requiring privileges but no user interaction.

The primary impact of this vulnerability is unauthorized deletion of user feedback posts, which compromises data integrity within the Scoold platform. For organizations relying on Scoold for internal knowledge sharing and collaboration, this could lead to loss of valuable feedback, disruption of communication, and potential mistrust among users. Although the vulnerability does not directly affect confidentiality or availability, the ability for low-privilege users to delete others' content can be exploited for sabotage, harassment, or to cover tracks in insider threat scenarios. In environments where feedback data is critical for decision-making or compliance, such unauthorized deletions could have operational and reputational consequences. Since exploitation requires only authenticated access, any compromised or malicious user account can leverage this flaw. The lack of known exploits in the wild reduces immediate risk but does not eliminate the threat, especially in targeted attacks or insider misuse.

Organizations using Scoold versions prior to 1.66.1 should upgrade immediately to version 1.66.1 or later, where the authorization flaw has been patched. Until upgrade is possible, administrators should restrict user registration and monitor feedback deletion activities closely for suspicious behavior. Implementing additional access controls at the application or proxy level to verify ownership or privilege before allowing deletion requests can serve as a temporary mitigation. Logging and alerting on deletion requests, especially those initiated by low-privilege users, can help detect exploitation attempts. Educating users about the importance of account security and monitoring for compromised accounts is also recommended. Finally, conducting regular audits of feedback data integrity can help identify unauthorized deletions promptly.