Medium severity4.3NVD Advisory· Published Oct 16, 2026· Updated Oct 16, 2026
CVE-2026-111603
CVE-2026-111603
Description
PlayEdu through 2.3 contains a missing authorization vulnerability in the CourseController that allows authenticated students to access department-restricted courses by omitting the department visibility check. Attackers can enumerate sequential course and attachment IDs via the course details and attachment download endpoints to obtain course structure and attachment files from other departments.
Affected products
1Patches
Vulnerability mechanics
References
3- github.com/PlayEdu/PlayEdu/blob/2.3/playedu-api/playedu-api/src/main/java/xyz/playedu/api/controller/frontend/CourseController.javanvd
- hackmd.io/@hieuPenguinnn/playedu-course-attachment-cross-department-authznvd
- www.vulncheck.com/advisories/playedu-through-2.3-missing-authorization-via-student-coursecontroller-endpointsnvd
News mentions
0No linked articles in our index yet.