The vulnerability in Koollab LMS version 5.3.2 involves improper access control on the SCORM API endpoint, enabling unauthenticated attackers to access other users' personal and learning progress data. This exposure includes user names, internal IDs, scores, lesson status, lesson position, and cached lesson state. The CVSS 3.1 base score is 3.7, reflecting low impact primarily on confidentiality. No integrity or availability impacts are reported. No vendor advisory or patch information is currently provided, and the product is not a cloud service, so remediation responsibility lies with the user organization.

An attacker without authentication can read sensitive user information related to learning progress and identity. This could lead to privacy violations but does not affect data integrity or system availability. The impact is limited to information disclosure with no known active exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the SCORM API endpoint where possible and monitor for unusual access patterns. No official remediation or temporary fixes have been published by the vendor.