CVE-2026-56877 describes a CWE-472 vulnerability in Skillable's SCORM lab launch integration where the client-supplied userId parameter is not validated against the authenticated SCORM session token. This lack of validation permits an authenticated user to substitute arbitrary userId values, bypassing per-user lab launch rate limits and consuming other users' lab allocations. This results in denial of service against targeted users' access to labs and exams. The vulnerability was published on 2026-07-13 and carries a CVSS 3.1 score of 6.3 (medium severity). No patch or remediation information is currently available, and no known exploits in the wild have been reported.

An authenticated user can exploit this vulnerability to bypass lab launch rate limits assigned per user and consume lab allocations belonging to other users. This leads to denial of service conditions for those targeted users, preventing them from accessing their labs and exams as intended. The confidentiality, integrity, and availability impacts are rated low, low, and low respectively by the CVSS vector, with availability impact being notable due to denial of service.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, organizations should monitor for unusual lab usage patterns and restrict access to trusted users. Since no official remediation or temporary fix is provided, no definitive mitigation steps can be recommended beyond vendor consultation.