CVE-2026-63242

A business logic vulnerability in Koollab LMS allows authenticated learners to falsely mark their lesson completion status as completed through the SCORM commit endpoint, bypassing the requirement to view the lesson material. This can compromise the integrity of training and completion records, potentially impacting educational outcomes and compliance. Organizations using Koollab LMS should prioritize addressing this vulnerability to maintain accurate training records and prevent misuse.