CVE-2026-25885 PolarLearn allows Unauthenticated WebSocket access allows subscribing to and posting in arbitrary group chats
Unauthenticated users can subscribe to and post messages in any group chat, allowing unauthorized access to private conversations and data modification.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-25885?
CVE-2026-25885 is a critical missing authorization vulnerability in polarnl PolarLearn, published on 9 Feb 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
PolarLearn is a free and open-source learning program. In 0-PRERELEASE-16 and earlier, the group chat WebSocket at wss://polarlearn.nl/api/v1/ws can be used without logging in. An unauthenticated client can subscribe to any group chat by providing a group UUID, and can also send messages to any group. The server accepts the message and stores it in the group’s chatContent, so this is not just a visual spam issue.
Which versions are affected by CVE-2026-25885?
It affects 1 product.
Products include Polarlearn Polarlearn.
How do I fix CVE-2026-25885?
No fix has been published for CVE-2026-25885 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-25885 being exploited?
There is no known exploitation of CVE-2026-25885 in the wild and no public exploit code.
Other vulnerabilities in polarnl PolarLearn
- CVE-2026-39322 PolarLearn: Any password authenticates banned accounts and grants API access
- CVE-2026-35610 PolarLearn has a Server Action Admin Bypass in Account Management Actions
- CVE-2026-25126 PolarLearn's unvalidated vote direction allows vote count manipulation
- CVE-2026-25222 PolarLearn Affected by User Enumeration via Argon2 Timing Attack on Sign-In Endpoint
- CVE-2026-25221 PolarLearn has Multiple Login CSRFs via Missing OAuth state Parameter (GitHub & Google)
Sources
Also known as GHSA-gvjm-5pw7-6c8c.