Scoold versions before 1.69.0 contain a missing authorization check in the ApiController.getPostReplies() method. When the configuration flags scoold.api_user_access_enabled and scoold.api_enabled are true, users possessing personal API tokens can access replies to questions in private spaces without proper permission checks. The GET /api/posts/{id}/answers endpoint returns private reply bodies even if the user cannot access the question itself, leading to unauthorized disclosure of confidential information. This vulnerability is addressed by applying access control checks before returning answer data in version 1.69.0.

The vulnerability allows unauthorized users with personal API tokens to read replies to private questions they should not access, exposing potentially sensitive or confidential team or project discussions. The confidentiality of private spaces is compromised, but integrity and availability are not affected. The CVSS 3.1 score is 6.5 (medium severity), reflecting network attack vector, low attack complexity, requiring privileges, no user interaction, and high confidentiality impact.

Upgrade Scoold to version 1.69.0 or later, where this missing authorization check is fixed. Until then, consider disabling scoold.api_user_access_enabled or scoold.api_enabled if feasible to reduce exposure. Patch status is confirmed fixed in 1.69.0.