Vulnerability · Published Jan 29, 2026 · Assigned by GitHub_M
CVE-2026-25126PolarLearn's unvalidated vote direction allows vote count manipulation
High 7.1
In plain English
A high-severity improper input validation in PolarLearn from polarnl. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 32% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.
Official description
PolarLearn is a free and open-source learning program. Prior to version 0-PRERELEASE-15, the vote API route (`POST /api/v1/forum/vote`) trusts the JSON body’s `direction` value without runtime validation. TypeScript types are not enforced at runtime, so an attacker can send arbitrary strings (e.g., `"x"`) as `direction`. Downstream (`VoteServer`) treats any non-`"up"` and non-`null` value as a downvote and persists the invalid value in `votes_data`. This can be exploited to bypass intended business logic. Version 0-PRERELEASE-15 fixes the vulnerability.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| polarnl | PolarLearn | < 0-PRERELEASE-15 |
Weakness: CWE-20 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N