Threats tagged 'ghsa-3gfx-j948-6jm4'

LearnHouse versions before 1.1.1 have a missing authorization vulnerability in the assignment API. This flaw allows authenticated users to access other users' grades, submissions, and instructor feedback by supplying another user's ID to certain endpoints. The vulnerability exposes sensitive academic data without proper access controls.