The vulnerability in Koollab LMS (version 5.3.2) involves improper validation in the SCORM commit endpoint, enabling authenticated learners to set their lesson completion status to completed without engaging with the lesson content. This business logic flaw compromises the accuracy of training completion data. The CVSS 3.1 base score is 4.3, reflecting low attack complexity and low privileges required, with no user interaction needed. The vendor has not provided an official fix or remediation level, and no patch links are available. The product is not a cloud service, so remediation depends on vendor updates to the software.

The impact is limited to integrity loss of training and completion records within Koollab LMS. Attackers can falsely mark lessons as completed, potentially affecting compliance, certification, or training audit processes. There is no direct confidentiality or availability impact reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or workaround is provided, organizations should monitor for vendor updates and consider restricting access to the SCORM commit endpoint or implementing additional validation controls if possible.