Threats affecting pkg:github/learnhouse

LearnHouse versions prior to 1.1.1 have an authorization bypass vulnerability in the assignment API. Authenticated users can exploit this flaw to access other users' grades, submissions, and instructor feedback by supplying a different user_id to the submissions grade endpoint or related read functions. This issue is fixed in version 1.1.1.

LearnHouse versions prior to 1.4.0 have a missing authorization vulnerability in the playground duplication API endpoint. Authenticated users with playground creation rights can duplicate restricted or unpublished playgrounds without proper read-access or draft checks, allowing them to copy and republish content publicly. This issue is fixed in version 1.4.0.