Skip to content
OpenAdvisories
High · 7.1 Public exploit CVE-2026-25126 EUVD-2026-4937

PolarLearn's unvalidated vote direction allows vote count manipulation

Published Jan 29, 2026 · Updated Feb 2, 2026 · Assigned by GitHub_M

Vendor: polarnl Product: PolarLearn

Description

PolarLearn is a free and open-source learning program. Prior to version 0-PRERELEASE-15, the vote API route (`POST /api/v1/forum/vote`) trusts the JSON body’s `direction` value without runtime validation. TypeScript types are not enforced at runtime, so an attacker can send arbitrary strings (e.g., `"x"`) as `direction`. Downstream (`VoteServer`) treats any non-`"up"` and non-`null` value as a downvote and persists the invalid value in `votes_data`. This can be exploited to bypass intended business logic. Version 0-PRERELEASE-15 fixes the vulnerability.

Affected products

VendorProductAffectedFixed
polarnl PolarLearn < 0-PRERELEASE-15 —

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 1 repository

  • Jvr2022/CVE-2026-25126 ★ 1 · Jan 31, 2026

    CVE-2026-25126 Proof-of-Concept demonstrating vote count manipulation in PolarLearn due to improper runtime validation of the forum vote direction parameter. Published after upstream patch release.

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

References