The vulnerability in Koollab LMS (version 5.3.2) involves improper access control (CWE-284) that permits an unauthenticated attacker to forcibly terminate sessions of other users by leveraging the login kickout endpoint with the victim's email address. This results in a denial of service condition for the targeted user. There is no indication of confidentiality or integrity impact, only availability is affected at a low level. No official patch or remediation level has been provided by the vendor as of the publication date.

An attacker can cause denial of service by terminating active user sessions without authentication, disrupting user access to the LMS. There is no impact on confidentiality or integrity. The severity is low, reflecting limited impact and the requirement for knowledge of the victim's email address.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, organizations should monitor for unusual session termination activity and consider additional access controls or rate limiting on the login kickout endpoint if possible.