CVE-2026-24900

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-24900", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-01-27T19:35:20.529Z", "datePublished": "2026-02-09T18:39:52.161Z", "dateUpdated": "2026-02-10T16:01:21.289Z"}, "containers": {"cna": {"title": "MarkUs has a submission-view IDOR exposes all student submissions", "problemTypes": [{"descriptions": [{"cweId": "CWE-639", "lang": "en", "description": "CWE-639: Authorization Bypass Through User-Controlled Key", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/MarkUsProject/Markus/security/advisories/GHSA-56gh-8hmq-7q88", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/MarkUsProject/Markus/security/advisories/GHSA-56gh-8hmq-7q88"}, {"name": "https://github.com/MarkUsProject/Markus/commit/7daed9fd2d44932223798d997b55094a3bff104b", "tags": ["x_refsource_MISC"], "url": "https://github.com/MarkUsProject/Markus/commit/7daed9fd2d44932223798d997b55094a3bff104b"}, {"name": "https://github.com/MarkUsProject/Markus/releases/tag/v2.9.1", "tags": ["x_refsource_MISC"], "url": "https://github.com/MarkUsProject/Markus/releases/tag/v2.9.1"}], "affected": [{"vendor": "MarkUsProject", "product": "Markus", "versions": [{"version": "< 2.9.1", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-09T18:39:52.161Z"}, "descriptions": [{"lang": "en", "value": "MarkUs is a web application for the submission and grading of student assignments. Prior to 2.9.1, the courses/<:course_id>/assignments/<:assignment_id>/submissions/html_content accepted a select_file_id parameter to serve SubmissionFile objects containing a record of files submitted by students. This parameter was not correctly scoped to the requesting user, allowing users access arbitrary submission file contents by id. This vulnerability is fixed in 2.9.1."}], "source": {"advisory": "GHSA-56gh-8hmq-7q88", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-10T15:30:26.838188Z", "id": "CVE-2026-24900", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-10T16:01:21.289Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-24900", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-10T15:30:26.838188Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-10T15:30:27.490Z"}}], "cna": {"title": "MarkUs has a submission-view IDOR exposes all student submissions", "source": {"advisory": "GHSA-56gh-8hmq-7q88", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "MarkUsProject", "product": "Markus", "versions": [{"status": "affected", "version": "< 2.9.1"}]}], "references": [{"url": "https://github.com/MarkUsProject/Markus/security/advisories/GHSA-56gh-8hmq-7q88", "name": "https://github.com/MarkUsProject/Markus/security/advisories/GHSA-56gh-8hmq-7q88", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/MarkUsProject/Markus/commit/7daed9fd2d44932223798d997b55094a3bff104b", "name": "https://github.com/MarkUsProject/Markus/commit/7daed9fd2d44932223798d997b55094a3bff104b", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/MarkUsProject/Markus/releases/tag/v2.9.1", "name": "https://github.com/MarkUsProject/Markus/releases/tag/v2.9.1", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "MarkUs is a web application for the submission and grading of student assignments. Prior to 2.9.1, the courses/<:course_id>/assignments/<:assignment_id>/submissions/html_content accepted a select_file_id parameter to serve SubmissionFile objects containing a record of files submitted by students. This parameter was not correctly scoped to the requesting user, allowing users access arbitrary submission file contents by id. This vulnerability is fixed in 2.9.1."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-639", "description": "CWE-639: Authorization Bypass Through User-Controlled Key"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-09T18:39:52.161Z"}}}, "cveMetadata": {"cveId": "CVE-2026-24900", "state": "PUBLISHED", "dateUpdated": "2026-02-10T16:01:21.289Z", "dateReserved": "2026-01-27T19:35:20.529Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-02-09T18:39:52.161Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "Markus", "vendor": "MarkUsProject", "versions": [{"status": "affected", "version": "< 2.9.1"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:markusproject:markus:*:*:*:*:*:*:*:*", "matchCriteriaId": "2D6B2B7B-F46C-4CEE-86D4-B25D3746747A", "versionEndExcluding": "2.9.1", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "MarkUs is a web application for the submission and grading of student assignments. Prior to 2.9.1, the courses/<:course_id>/assignments/<:assignment_id>/submissions/html_content accepted a select_file_id parameter to serve SubmissionFile objects containing a record of files submitted by students. This parameter was not correctly scoped to the requesting user, allowing users access arbitrary submission file contents by id. This vulnerability is fixed in 2.9.1."}, {"lang": "es", "value": "MarkUs es una aplicaci\u00f3n web para la entrega y calificaci\u00f3n de tareas de estudiantes. Antes de 2.9.1, la ruta courses/&lt;:course_id&gt;/assignments/&lt;:assignment_id&gt;/submissions/html_content aceptaba un par\u00e1metro select_file_id para servir objetos SubmissionFile que conten\u00edan un registro de los archivos entregados por los estudiantes. Este par\u00e1metro no estaba correctamente acotado al usuario solicitante, permitiendo a los usuarios acceder a contenidos arbitrarios de archivos de entrega por ID. Esta vulnerabilidad est\u00e1 corregida en 2.9.1."}], "id": "CVE-2026-24900", "lastModified": "2026-06-17T10:23:46.567", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-24900", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-02-10T15:30:26.838188Z", "version": "2.0.3"}}]}, "published": "2026-02-09T20:15:56.387", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/MarkUsProject/Markus/commit/7daed9fd2d44932223798d997b55094a3bff104b"}, {"source": "security-advisories@github.com", "tags": ["Product", "Release Notes"], "url": "https://github.com/MarkUsProject/Markus/releases/tag/v2.9.1"}, {"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/MarkUsProject/Markus/security/advisories/GHSA-56gh-8hmq-7q88"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-639"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,2.9.1)"}}], "product": "markus", "vendor": "markusproject"}], "analysis": {"en": {"generated_at": "2026-04-18T13:00:21.792597+00:00", "value": {"mitigation_remediation": ["Upgrade MarkUs to version 2.9.1 or newer where the IDOR issue has been fixed.", "Review deployment to ensure no older MarkUs instances remain exposed.", "Verify that users cannot guess or enumerate file IDs by testing endpoint access with random identifiers."], "summary": {"action": "Patch", "impact": "Unauthorized Disclosure of Student Submissions via IDOR"}, "threat_synthesis": {"affected_systems": "The MarkUs web application, specifically any installation of MarkUsProject:Markus before the 2.9.1 release, is affected. These versions lack the fix that properly scopes file access to the requesting user, thus enabling the described exploit.", "description_and_impact": "A flawed parameter handling in the submission viewing endpoint allowed any authenticated user to request files belonging to other students, resulting in unauthorized access to potentially sensitive academic work. The weakness originates from an improper scope check on the select_file_id parameter, permitting arbitrary file content retrieval without verifying ownership or course enrollment. Consequently, confidentiality of all submissions is exposed to any user who can use the vulnerable endpoint.", "risk_and_exploitability": "The CVSS score of 6.5 indicates a moderate severity, meaning the vulnerability could be leveraged by any authenticated user. However, the EPSS score of less than 1% suggests low current exploit probability, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires only the ability to send a crafted request containing a valid file ID, which can be done through the web browser or via automated scripts by any user logged into the system. No additional privileges or code execution are necessary; the impact is strictly information disclosure."}}}}, "created": "2026-02-10T11:35:17.002130+00:00", "updated": "2026-04-18T13:15:25.703673+00:00", "vendors": ["markusproject", "markusproject$PRODUCT$markus"]}