CVE-2026-56877: CWE-472 External Control of Assumed-Immutable Web Parameter in Skillable SCORM Lab Launch Integration
The SCORM lab launch endpoint in Skillable (scorm.skillable.com) through 2026-07-13 does not validate the client-supplied userId parameter against the authenticated SCORM session token. An authenticated user can substitute arbitrary userId values to bypass per-user lab launch rate limits and consume other users' lab allocations, resulting in denial of service against targeted users' lab and exam access. Skillable was formerly named Learn on Demand Systems.
AI Analysis
Technical Summary
The SCORM lab launch endpoint in Skillable (scorm.skillable.com) through 2026-07-13 fails to validate the client-supplied userId parameter against the authenticated SCORM session token. This external control of an assumed-immutable web parameter (CWE-472) enables authenticated users to impersonate other users by substituting arbitrary userId values. Consequently, attackers can bypass per-user lab launch rate limits and exhaust other users' lab and exam allocations, resulting in denial of service against those users' access.
Potential Impact
An authenticated user can bypass per-user lab launch rate limits and consume other users' lab allocations. This leads to denial of service conditions for targeted users, preventing them from accessing their labs and exams as intended.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, monitor for unusual lab launch activity and restrict user permissions as feasible to limit abuse.
CVE-2026-56877: CWE-472 External Control of Assumed-Immutable Web Parameter in Skillable SCORM Lab Launch Integration
Description
The SCORM lab launch endpoint in Skillable (scorm.skillable.com) through 2026-07-13 does not validate the client-supplied userId parameter against the authenticated SCORM session token. An authenticated user can substitute arbitrary userId values to bypass per-user lab launch rate limits and consume other users' lab allocations, resulting in denial of service against targeted users' lab and exam access. Skillable was formerly named Learn on Demand Systems.
CVSS v3.1
Score 6.3medium
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The SCORM lab launch endpoint in Skillable (scorm.skillable.com) through 2026-07-13 fails to validate the client-supplied userId parameter against the authenticated SCORM session token. This external control of an assumed-immutable web parameter (CWE-472) enables authenticated users to impersonate other users by substituting arbitrary userId values. Consequently, attackers can bypass per-user lab launch rate limits and exhaust other users' lab and exam allocations, resulting in denial of service against those users' access.
Potential Impact
An authenticated user can bypass per-user lab launch rate limits and consume other users' lab allocations. This leads to denial of service conditions for targeted users, preventing them from accessing their labs and exams as intended.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, monitor for unusual lab launch activity and restrict user permissions as feasible to limit abuse.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- mitre
- Date Reserved
- 2026-06-23T15:43:45.665Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a5560a568715ace43f2b52b
Added to database: 07/13/2026, 22:03:17 UTC
Last enriched: 07/13/2026, 22:17:34 UTC
Last updated: 07/13/2026, 22:33:08 UTC
Views: 4
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.