CVE-2026-39354

BRIEFING NOTE OVERVIEW CVE-2026-39354 is an authenticated authorization flaw in Scoold, a Q&A and knowledge sharing platform for teams. Versions prior to 1.66.2 are affected. The vulnerability permits low-privilege, authenticated users to overwrite existing questions by submitting another user's public question ID to the POST /questions/ask endpoint. Since question IDs are publicly visible in URLs, attackers can identify target questions and replace them with malicious content. SEVERITY The vulnerability carries a CVSS v3.1 score of 6.5 (MEDIUM) with a network-based attack vector requiring low privilege authentication. Attack complexity is low, meaning minimal effort is needed to exploit the flaw. The primary impact is high integrity loss of user-generated content, as attacker-controlled data overwrites legitimate questions and corrupts discussion threads. No confidentiality or availability impact is documented. EXPLOITATION STATUS Currently, there is no evidence of active exploitation in the wild, and CVE-2026-39354 does not appear on the CISA Known Exploited Vulnerabilities list. Community attention remains low, as indicated by the FAUCET Risk Score of 44.0/100 and EPSS score of 0.000310000, suggesting this vulnerability has received minimal threat actor focus to date. Organizations should prioritize patching to version 1.66.2 to prevent potential future exploitation, particularly if Scoold is deployed in environments where data integrity is critical.