PolarLearn: 任意のパスワードで禁止されたアカウントを認証し、API へのアクセスを許可する

An attacker exploiting this vulnerability can bypass the intended restrictions placed on banned user accounts. By crafting a specific POST request to the /api/v1/auth/sign-in endpoint, an attacker can create a valid session even if the account is flagged as banned. This session is then accepted across authenticated API routes, effectively allowing the attacker to impersonate the banned user. The potential impact includes unauthorized access to account data, modification of learning materials, and potentially even administrative actions depending on the permissions associated with the banned account. This could compromise the integrity and confidentiality of the learning platform.

Organizations and individuals using PolarLearn versions 0.0.0 through v0-PRERELEASE-15 are at risk. This includes educational institutions, training providers, and anyone utilizing PolarLearn for online learning programs. Shared hosting environments running PolarLearn are particularly vulnerable, as a compromise of one account could potentially lead to broader access.

• nodejs / server:

# Check for PolarLearn processes
ps aux | grep PolarLearn

# Monitor API logs for suspicious login attempts from banned accounts (check for 'banned' status in user records)
grep 'banned' /var/log/polarlearn/api.log

• generic web:

# Check for exposed /api/v1/auth/sign-in endpoint
curl -I https://your-polarlearn-instance/api/v1/auth/sign-in

1. 2026-04-07Disclosure

   disclosure

1. 予約済み2026-04-06
2. 公開日2026-04-07
3. 更新日2026-04-09
4. EPSS 更新日2026-04-15

The primary mitigation for CVE-2026-39322 is to upgrade PolarLearn to version 0.0.2 or later, which contains the fix for this authentication bypass. If upgrading is not immediately feasible, consider implementing temporary workarounds such as stricter input validation on the /api/v1/auth/sign-in endpoint to prevent the creation of sessions for banned accounts. Review and enhance existing ban enforcement mechanisms to ensure they are correctly preventing access to authenticated routes. Monitor API logs for suspicious login attempts or unusual activity associated with banned accounts.