Vulnerability · Published Oct 16, 2026 · Assigned by VulnCheck

CVE-2026-111603PlayEdu through 2.3 Missing Authorization via Student CourseController Endpoints

Medium 4.3

In plain English

A medium-severity authorization bypass via user-controlled key in PlayEdu from PlayEdu. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 25% of all known vulnerabilities).

Severity (CVSS 3.1)4.3Medium

Exploit odds (30 days)0.3%top 75.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

PlayEdu through 2.3 contains a missing authorization vulnerability in the CourseController that allows authenticated students to access department-restricted courses by omitting the department visibility check. Attackers can enumerate sequential course and attachment IDs via the course details and attachment download endpoints to obtain course structure and attachment files from other departments.

Affected products (as reported)

Vendor	Product	Versions
PlayEdu	PlayEdu	0 – through 2.3

Weakness: CWE-639 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

References

https://hackmd.io/@hieuPenguinnn/playedu-course-attachment-cross-department-authz third-party-advisory
https://github.com/PlayEdu/PlayEdu/blob/2.3/playedu-api/playedu-api/src/main/java/xyz/playedu/api/controller/frontend/CourseController.java#L57-L132 technical-description
https://github.com/PlayEdu/PlayEdu product
VulnCheck Advisory: PlayEdu through 2.3 Missing Authorization via Student CourseController Endpoints third-party-advisory