Search
Find a vulnerability
Search criteria
3 vulnerabilities by Skillable
GCVE-1988-2026-0352
Vulnerability from gna-1988 – Published: 2026-09-11 07:55 – Updated: 2026-09-11 07:55
VLAI
EPSS
VEX
Title
CVE-2026-56877 - Skillable SCORM userId authorisation bypass
Summary
Skillable's SCORM lab launch endpoint validates a launch token but
enforces per-user allocation limits using a browser-supplied userId
that is not bound to the validated token. An authenticated learner
can modify this identifier to bypass configured limits, launch
concurrent lab instances, and consume another learner's allocation.
Skillable states that no fix is planned for the legacy SCORM launch
path. CVE-2026-56877 was assigned by MITRE.
1. Advisory information
-----------------------
Title: CVE-2026-56877 - Skillable SCORM userId authorisation
bypass
Advisory: https://github.com/GregDurys/security-advisories/tree/main/skillable
CVE: CVE-2026-56877 (assigned; record publication pending)
Class: CWE-639 (Authorization Bypass Through User-Controlled Key)
CVSS: 6.5 (Medium) - AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Date: 2026-07-12
Author: Greg Durys <https://payloadforge.io>
2. Affected software
--------------------
Vendor: Skillable (formerly Learn on Demand Systems)
Service: Hosted SCORM lab provisioning (cloud service, no
on-premises deployment)
Endpoint: scorm.skillable.com/scorm/launch
Tested: 2026-04-28 to 2026-05-03 (production endpoint, via the
Red Team Ops course on the Zero Point Security platform)
Fix: None. The vendor states that no server-side identity
validation will be added to the SCORM launch path.
Remediation is migration to an API or LTI 1.3 launch
integration.
3. Testing scope
----------------
All validation was performed within a normal student workflow on
the Red Team Ops course. The bypass and the cross-user denial of
service were confirmed against the production endpoint. The
certification exam endpoint was not tested; Skillable subsequently
confirmed to an affected customer that the same weakness could
affect exam allocations and could return details associated with
another learner's session.
4. Summary
----------
The SCORM launch request is assembled and initiated client-side.
Loading a lab unit builds a launch URL and requests it from
scorm.skillable.com with a SCORM token and userId as query
parameters. Skillable validates the token sufficiently to authorise
the launch, then evaluates the per-user launch limit against the
supplied userId. The token is server-validated, while the userId is
client-controlled,
and no binding between the two is enforced.
The userId accepts arbitrary strings with no format validation.
Values with a non-hexadecimal character in an otherwise
expected-length identifier, and entirely fabricated structures, were
both accepted and provisioned lab instances. The same SCORM token
launches labs under different userId values, demonstrating that the token does not bind the launch to the
supplied userId. The token remained unchanged
across the tested launches, indicating that it did not provide a
user-specific binding to the supplied userId.
(a) Rate-limit bypass. Launching with a modified userId bypassed the
per-user limit and provisioned a fresh LabInstanceId. Two
concurrent instances under different userId values were confirmed.
(b) Cross-user denial of service. A consenting colleague's userId
was obtained through an authenticated learner enumeration vector
on the LMS. A lab launched under that userId consumed the
colleague's allocation. The colleague then attempted to launch
the same lab and was locked out, while other labs launched
normally.
(c) Cost. Each instance provisions cloud VMs (typically a domain
controller plus one to three machines, active 30 to 60 minutes)
at the course provider's expense. An authenticated learner
enumeration vector on the LMS would scale any of the above
across the enumerable enrolled population.
5. Remediation
--------------
Bind the launch to a server-validated learner identity, for example
through a user-scoped signed token or server-to-server integration.
Do not enforce per-user limits using an unverified browser-supplied
userId. Skillable states that it will not add this binding to the
legacy SCORM path and recommends migration to its API or LTI 1.3
integration.
6. Disclosure timeline
----------------------
2026-04-28 Per-user rate-limit error observed; userId modification
returned a new LabInstanceId
2026-04-29 Concurrent lab instances confirmed against a single
account
2026-05-03 Cross-user denial of service confirmed with a consenting
fellow student
2026-05-08 Findings documented; Skillable support ticket #4043837
raised; disclosure channel provided
2026-05-11 Report submitted to Disclosures () skillable com (encrypted
archive)
2026-05-13 Skillable acknowledged receipt (Nat Shere, Manager,
Product Security)
2026-05-19 CVE request submitted to MITRE (Skillable is not a CNA)
2026-05-27 Status request to Skillable; no response
2026-06-08 Second follow-up, restating the 60-day disclosure window
(closing 2026-07-12)
2026-06-10 Skillable responded that the issue is "an inherent flaw
in the SCORM technology" and requested no disclosure
without written permission
2026-06-10 Pushback sent; open-ended embargo declined; 2026-07-12
date held
2026-06-23 MITRE assigned CVE-2026-56877; coordinated disclosure
remained under embargo until 2026-07-12
2026-06-26 Skillable sent at least one affected customer an
advisory ("SCORM-based lab launches and recommended
migration"; no CVE, no CVSS), stating no server-side
fix and recommending migration
2026-06-26 Coordination update sent to Skillable
2026-07-12 Advisory published
7. Current status
-----------------
Vendor fix: The vendor states that no fix is planned for
the SCORM launch path
Vendor remediation: Migration to an API or LTI 1.3 launch
integration
Customer communication: Sent to at least one affected customer on
2026-06-26 (private notification, no CVE,
no CVSS)
CVE: CVE-2026-56877, assigned by the MITRE CNA of
Last Resort
8. References
-------------
- https://github.com/GregDurys/security-advisories/tree/main/skillable
- https://www.cve.org/CVERecord?id=CVE-2026-56877
- https://cwe.mitre.org/data/definitions/639.html
- https://payloadforge.io/beyond-crto-skillable
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/
Severity
No CVSS data available.
CWE
Assigner
References
9 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Skillable | SCORM Lab Launch Integration |
Affected:
unknown
|
Relationships
reference
GCVE-1988-2026-0352 (this record)
- related CVE-2026-56877
{
"containers": {
"cna": {
"affected": [
{
"product": "SCORM Lab Launch Integration",
"vendor": "Skillable",
"versions": [
{
"status": "affected",
"version": "unknown"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Greg via Fulldisclosure"
}
],
"descriptions": [
{
"lang": "en",
"value": "Skillable\u0027s SCORM lab launch endpoint validates a launch token but\nenforces per-user allocation limits using a browser-supplied userId\nthat is not bound to the validated token. An authenticated learner\ncan modify this identifier to bypass configured limits, launch\nconcurrent lab instances, and consume another learner\u0027s allocation.\nSkillable states that no fix is planned for the legacy SCORM launch\npath. CVE-2026-56877 was assigned by MITRE.\n\n\n1. Advisory information\n-----------------------\nTitle: CVE-2026-56877 - Skillable SCORM userId authorisation\nbypass\nAdvisory: https://github.com/GregDurys/security-advisories/tree/main/skillable\nCVE: CVE-2026-56877 (assigned; record publication pending)\nClass: CWE-639 (Authorization Bypass Through User-Controlled Key)\nCVSS: 6.5 (Medium) - AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\nDate: 2026-07-12\nAuthor: Greg Durys \u003chttps://payloadforge.io\u003e\n\n\n2. Affected software\n--------------------\nVendor: Skillable (formerly Learn on Demand Systems)\nService: Hosted SCORM lab provisioning (cloud service, no\non-premises deployment)\nEndpoint: scorm.skillable.com/scorm/launch\nTested: 2026-04-28 to 2026-05-03 (production endpoint, via the\nRed Team Ops course on the Zero Point Security platform)\nFix: None. The vendor states that no server-side identity\nvalidation will be added to the SCORM launch path.\nRemediation is migration to an API or LTI 1.3 launch\nintegration.\n\n\n3. Testing scope\n----------------\nAll validation was performed within a normal student workflow on\nthe Red Team Ops course. The bypass and the cross-user denial of\nservice were confirmed against the production endpoint. The\ncertification exam endpoint was not tested; Skillable subsequently\nconfirmed to an affected customer that the same weakness could\naffect exam allocations and could return details associated with\nanother learner\u0027s session.\n\n\n4. Summary\n----------\nThe SCORM launch request is assembled and initiated client-side.\nLoading a lab unit builds a launch URL and requests it from\nscorm.skillable.com with a SCORM token and userId as query\nparameters. Skillable validates the token sufficiently to authorise\nthe launch, then evaluates the per-user launch limit against the\nsupplied userId. The token is server-validated, while the userId is\nclient-controlled,\nand no binding between the two is enforced.\n\nThe userId accepts arbitrary strings with no format validation.\nValues with a non-hexadecimal character in an otherwise\nexpected-length identifier, and entirely fabricated structures, were\nboth accepted and provisioned lab instances. The same SCORM token\nlaunches labs under different userId values, demonstrating that the token does not bind the launch to the\nsupplied userId. The token remained unchanged\nacross the tested launches, indicating that it did not provide a\nuser-specific binding to the supplied userId.\n\n(a) Rate-limit bypass. Launching with a modified userId bypassed the\nper-user limit and provisioned a fresh LabInstanceId. Two\nconcurrent instances under different userId values were confirmed.\n\n(b) Cross-user denial of service. A consenting colleague\u0027s userId\nwas obtained through an authenticated learner enumeration vector\non the LMS. A lab launched under that userId consumed the\ncolleague\u0027s allocation. The colleague then attempted to launch\nthe same lab and was locked out, while other labs launched\nnormally.\n\n(c) Cost. Each instance provisions cloud VMs (typically a domain\ncontroller plus one to three machines, active 30 to 60 minutes)\nat the course provider\u0027s expense. An authenticated learner\nenumeration vector on the LMS would scale any of the above\nacross the enumerable enrolled population.\n\n\n5. Remediation\n--------------\nBind the launch to a server-validated learner identity, for example\nthrough a user-scoped signed token or server-to-server integration.\nDo not enforce per-user limits using an unverified browser-supplied\nuserId. Skillable states that it will not add this binding to the\nlegacy SCORM path and recommends migration to its API or LTI 1.3\nintegration.\n\n\n6. Disclosure timeline\n----------------------\n2026-04-28 Per-user rate-limit error observed; userId modification\nreturned a new LabInstanceId\n2026-04-29 Concurrent lab instances confirmed against a single\naccount\n2026-05-03 Cross-user denial of service confirmed with a consenting\nfellow student\n2026-05-08 Findings documented; Skillable support ticket #4043837\nraised; disclosure channel provided\n2026-05-11 Report submitted to Disclosures () skillable com (encrypted\narchive)\n2026-05-13 Skillable acknowledged receipt (Nat Shere, Manager,\nProduct Security)\n2026-05-19 CVE request submitted to MITRE (Skillable is not a CNA)\n2026-05-27 Status request to Skillable; no response\n2026-06-08 Second follow-up, restating the 60-day disclosure window\n(closing 2026-07-12)\n2026-06-10 Skillable responded that the issue is \"an inherent flaw\nin the SCORM technology\" and requested no disclosure\nwithout written permission\n2026-06-10 Pushback sent; open-ended embargo declined; 2026-07-12\ndate held\n2026-06-23 MITRE assigned CVE-2026-56877; coordinated disclosure\nremained under embargo until 2026-07-12\n2026-06-26 Skillable sent at least one affected customer an\nadvisory (\"SCORM-based lab launches and recommended\nmigration\"; no CVE, no CVSS), stating no server-side\nfix and recommending migration\n2026-06-26 Coordination update sent to Skillable\n2026-07-12 Advisory published\n\n\n7. Current status\n-----------------\nVendor fix: The vendor states that no fix is planned for\nthe SCORM launch path\nVendor remediation: Migration to an API or LTI 1.3 launch\nintegration\nCustomer communication: Sent to at least one affected customer on\n2026-06-26 (private notification, no CVE,\nno CVSS)\nCVE: CVE-2026-56877, assigned by the MITRE CNA of\nLast Resort\n\n\n8. References\n-------------\n- https://github.com/GregDurys/security-advisories/tree/main/skillable\n- https://www.cve.org/CVERecord?id=CVE-2026-56877\n- https://cwe.mitre.org/data/definitions/639.html\n- https://payloadforge.io/beyond-crto-skillable\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "CWE-639",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-11T07:55:57Z",
"orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"shortName": "VULNARCHIVE"
},
"references": [
{
"tags": [
"technical-description"
],
"url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jul/20"
},
{
"tags": [
"technical-description"
],
"url": "https://seclists.org/fulldisclosure/2026/Jul/20"
},
{
"url": "https://cwe.mitre.org/data/definitions/639.html"
},
{
"url": "https://github.com/GregDurys/security-advisories/tree/main/skillable"
},
{
"url": "https://nmap.org/mailman/listinfo/fulldisclosure"
},
{
"url": "https://payloadforge.io"
},
{
"url": "https://payloadforge.io/beyond-crto-skillable"
},
{
"url": "https://seclists.org/fulldisclosure/"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-56877"
}
],
"source": {
"defect": [
"https://seclists.org/fulldisclosure/2026/Jul/20"
],
"discovery": "EXTERNAL"
},
"title": "CVE-2026-56877 - Skillable SCORM userId authorisation bypass",
"x_gcve": [
{
"recordType": "reference",
"relationships": [
{
"destId": "CVE-2026-56877",
"type": "related"
}
],
"vulnId": "GCVE-1988-2026-0352",
"x_vulnarchive": {
"archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jul/20",
"automated": true,
"contentSha256": "585ca0c01365cf23961b9778b1126c606d723ea93385ebcf493a309fcfb6de37",
"evidenceScore": 8,
"messageId": "",
"originalUrl": "https://seclists.org/fulldisclosure/2026/Jul/20",
"policy": "vulnarchive-1",
"sourceFormat": "text/html",
"sourcePublishedAt": "2026-07-12T10:19:54Z"
}
},
{
"recordType": "advisory",
"vulnId": "gcve-1988-2026-0352"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"assignerShortName": "VULNARCHIVE",
"datePublished": "2026-09-11T07:55:57Z",
"dateUpdated": "2026-09-11T07:55:57Z",
"state": "PUBLISHED",
"vulnId": "GCVE-1988-2026-0352"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-56877 (GCVE-0-2026-56877)
Vulnerability from nvd – Published: 2026-07-13 21:51 – Updated: 2026-07-16 06:49
VLAI
EPSS
VEX
Summary
The SCORM lab launch endpoint in Skillable (scorm.skillable.com) through 2026-07-13 does not validate the client-supplied userId parameter against the authenticated SCORM session token. An authenticated user can substitute arbitrary userId values to bypass per-user lab launch rate limits and consume other users' lab allocations, resulting in denial of service against targeted users' lab and exam access. Skillable was formerly named Learn on Demand Systems.
Severity
6.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-14 12:46 UTC
CWE
- CWE-472 - External Control of Assumed-Immutable Web Parameter
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Skillable | SCORM Lab Launch Integration |
Affected:
0 , ≤ 2026-07-13
(custom)
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2026-07-16T06:49:11.082Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://www.openwall.com/lists/oss-security/2026/07/12/1"
},
{
"url": "http://www.openwall.com/lists/oss-security/2026/07/12/2"
},
{
"url": "http://seclists.org/fulldisclosure/2026/Jul/20"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-56877",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-14T12:46:25.980656Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-14T12:46:32.749Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "SCORM Lab Launch Integration",
"vendor": "Skillable",
"versions": [
{
"lessThanOrEqual": "2026-07-13",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "The SCORM lab launch endpoint in Skillable (scorm.skillable.com) through 2026-07-13 does not validate the client-supplied userId parameter against the authenticated SCORM session token. An authenticated user can substitute arbitrary userId values to bypass per-user lab launch rate limits and consume other users\u0027 lab allocations, resulting in denial of service against targeted users\u0027 lab and exam access. Skillable was formerly named\u00a0Learn on Demand Systems."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-472",
"description": "CWE-472 External Control of Assumed-Immutable Web Parameter",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-13T21:51:43.515Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://www.skillable.com/security/"
},
{
"url": "https://www.openwall.com/lists/oss-security/2026/07/12/1"
}
],
"x_generator": {
"engine": "CVE-Request-form 0.0.1"
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2026-56877",
"datePublished": "2026-07-13T21:51:43.515Z",
"dateReserved": "2026-06-23T15:43:45.665Z",
"dateUpdated": "2026-07-16T06:49:11.082Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-56877 (GCVE-0-2026-56877)
Vulnerability from cvelistv5 – Published: 2026-07-13 21:51 – Updated: 2026-07-16 06:49
VLAI
EPSS
VEX
Summary
The SCORM lab launch endpoint in Skillable (scorm.skillable.com) through 2026-07-13 does not validate the client-supplied userId parameter against the authenticated SCORM session token. An authenticated user can substitute arbitrary userId values to bypass per-user lab launch rate limits and consume other users' lab allocations, resulting in denial of service against targeted users' lab and exam access. Skillable was formerly named Learn on Demand Systems.
Severity
6.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-14 12:46 UTC
CWE
- CWE-472 - External Control of Assumed-Immutable Web Parameter
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Skillable | SCORM Lab Launch Integration |
Affected:
0 , ≤ 2026-07-13
(custom)
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2026-07-16T06:49:11.082Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://www.openwall.com/lists/oss-security/2026/07/12/1"
},
{
"url": "http://www.openwall.com/lists/oss-security/2026/07/12/2"
},
{
"url": "http://seclists.org/fulldisclosure/2026/Jul/20"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-56877",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-14T12:46:25.980656Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-14T12:46:32.749Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "SCORM Lab Launch Integration",
"vendor": "Skillable",
"versions": [
{
"lessThanOrEqual": "2026-07-13",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "The SCORM lab launch endpoint in Skillable (scorm.skillable.com) through 2026-07-13 does not validate the client-supplied userId parameter against the authenticated SCORM session token. An authenticated user can substitute arbitrary userId values to bypass per-user lab launch rate limits and consume other users\u0027 lab allocations, resulting in denial of service against targeted users\u0027 lab and exam access. Skillable was formerly named\u00a0Learn on Demand Systems."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-472",
"description": "CWE-472 External Control of Assumed-Immutable Web Parameter",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-13T21:51:43.515Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://www.skillable.com/security/"
},
{
"url": "https://www.openwall.com/lists/oss-security/2026/07/12/1"
}
],
"x_generator": {
"engine": "CVE-Request-form 0.0.1"
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2026-56877",
"datePublished": "2026-07-13T21:51:43.515Z",
"dateReserved": "2026-06-23T15:43:45.665Z",
"dateUpdated": "2026-07-16T06:49:11.082Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}