VYPR
← All advisories
High severity7.5NVD Advisory· Published Feb 9, 2026· Updated Jun 17, 2026

CVE-2026-25885

CVE-2026-25885

Description

PolarLearn is a free and open-source learning program. In 0-PRERELEASE-16 and earlier, the group chat WebSocket at wss://polarlearn.nl/api/v1/ws can be used without logging in. An unauthenticated client can subscribe to any group chat by providing a group UUID, and can also send messages to any group. The server accepts the message and stores it in the group’s chatContent, so this is not just a visual spam issue.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

3
  • Polarnl/Polarlearn3 versions
    cpe:2.3:a:polarlearn:polarlearn:-:*:*:*:*:*:*:*+ 2 more
    • cpe:2.3:a:polarlearn:polarlearn:-:*:*:*:*:*:*:*
    • (no CPE)range: <=0-PRERELEASE-16
    • (no CPE)range: < 0-PRERELEASE-16

Patches

Vulnerability mechanics

References

2

News mentions

0

No linked articles in our index yet.