CVE-2026-41243 MEDIUM

CVE-2026-41243: OpenLearn's pending forum posts remain publicly readable by direct ID when moderation mode is enabled

Vendor Siemvk
Product OpenLearn
Weakness CWE-284
Published April 23, 2026
Last update April 23, 2026
View on NVD All CVEs

CVSS base score

6.9/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

What the vulnerability does

01Description

OpenLearn is open-source educational forum software. Prior to commit 844b2a40a69d0c4911580fe501923f0b391313ab, when `safeMode` is enabled, unapproved forum posts are hidden from the public list, but the direct post-read procedure still returns the full post to anyone with the post UUID. Commit 844b2a40a69d0c4911580fe501923f0b391313ab fixes the issue.

Key dates

02Disclosure timeline

April 23, 2026 CVE published
April 23, 2026 Record updated