Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.4

PolarLearn lets anyone send messages to any group chat

CVE-2026-25885 · published 8 months ago
Summary

The PolarLearn learning platform (versions up to 0‑PRERELEASE‑16) allows anyone on the internet to connect to its chat service without logging in. Because the connection does not require authentication, a stranger can join any group and post messages that are saved in the group’s history. Upgrade to a newer release that requires login for the chat service, or disable the WebSocket chat feature until it is patched.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
polarlearn polarlearn All versions
cpe:2.3:a:polarlearn:polarlearn:-:*:*:*:*:*:*:*
Original advisory text
PolarLearn allows Unauthenticated WebSocket access allows subscribing to and posting in arbitrary group chats
PolarLearn is a free and open-source learning program. In 0-PRERELEASE-16 and earlier, the group chat WebSocket at wss://polarlearn.nl/api/v1/ws can be used without logging in. An unauthenticated client can subscribe to any group chat by providing a group UUID, and can also send messages to any group. The server accepts the message and stores it in the group’s chatContent, so this is not just a visual spam issue.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker partial control
Severity
9.4 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-285Improper Authorization
CWE-306Missing Authentication for Critical Function
Timeline
Published9 Feb 2026
Updated4 Nov 2026
First seen6 Mar 2026
Sources
CVE-2026-25885 · NVD
GHSA-gvjm-5pw7-6c8c · GHSA
CVE-2026-25885 · OSV
Track software like this
Free during beta