Scoold, a Q&A and knowledge sharing platform, had an authorization flaw before version 1.66.2 where authenticated users with low privileges could overwrite questions authored by others. This was possible because the question IDs are publicly exposed and the POST /questions/ask endpoint did not properly verify ownership of the question ID supplied in the postId parameter. Exploiting this flaw results in attacker-controlled content replacing legitimate questions, compromising content integrity. The vulnerability is tracked as CVE-2026-39354 and is classified under CWE-639 (Authorization Bypass Through User-Controlled Key).

An attacker with any authenticated low-privilege account can overwrite existing questions posted by other users by supplying the victim's question ID. This causes loss of integrity of user-generated content and corrupts the discussion threads, potentially misleading users or disrupting knowledge sharing. There is no indication of confidentiality or availability impact. No known exploits in the wild have been reported.

This vulnerability is fixed in Scoold version 1.66.2. Users should upgrade to version 1.66.2 or later to remediate this issue. Since the vendor advisory does not explicitly state the remediation level, patch status is inferred from the version information. No additional mitigations are indicated.