Cyber Resilience

CVE-2025-12270

Access Control in Learnhouse ≤ 2025-09-21

Public PoCAccess Control
Published
27 October 2025
Modified
29 April 2026
CVSS Score v4 2.1
Click a component to see what it means
Raw vectorCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS Score 0.0038 31th percentile
Risk Priority 27 floored blend · peak EPSS

Summary

CVE-2025-12270 is a low-severity Resource Injection (CWE-99) vulnerability in Learnhouse Learnhouse. Its CVSS base score is 2.1 (Low).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 31th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified map to AC-24 (Access Control Decisions) and AC-3 (Access Enforcement) — see the control section below for these in your framework.

OWASP Top 10 for Web (2025)

EU & UK References

Vulnerability Data

A vulnerability was determined in LearnHouse up to 98dfad76aad70711a8113f6c1fdabfccf10509ca. The impacted element is an unknown function of the file /api/v1/assignments/{assignment_id}/tasks/{task_id}/sub_file of the component Student Assignment Submission Handler. This manipulation causes improper control of resource identifiers. The attack can be initiated…

more

remotely. The exploit has been publicly disclosed and may be utilized. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The vendor was contacted early about this disclosure but did not respond in any way.

CWE(s)

Related Threats

MITRE ATT&CK Enterprise Techniques

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
T1210 Exploitation of Remote Services Lateral Movement
Adversaries may exploit remote services to gain unauthorized access to internal systems once inside of a network.
Derived from this CVE’s CWE(s) via the direct CWE→ATT&CK cross-walk.

CVEs Like This One

CVE-2025-12269Same product: Learnhouse Learnhouse
CVE-2025-12268Same product: Learnhouse Learnhouse
CVE-2025-12276Same product: Learnhouse Learnhouse
CVE-2024-7437Shared CWE-639, CWE-99
CVE-2025-2125Shared CWE-639, CWE-99
CVE-2025-12919Shared CWE-639, CWE-99
CVE-2024-4817Shared CWE-639, CWE-99
CVE-2025-9263Shared CWE-639, CWE-99
CVE-2025-9264Shared CWE-639, CWE-99
CVE-2025-12918Shared CWE-639, CWE-99

Affected Assets

learnhouse
learnhouse
≤ 2025-09-21

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)

Detect
Catch it (NIST detect / respond)

Harden
Shrink the surface (DISA STIG)

Validate
Prove the fix (OWASP ASVS)
  • V1.3.8
  • V1.3.9
  • V1.3.11
  • V9.2.2

Mitigating Controls (NIST 800-53 r5) AI

Enforcing approved authorizations on every access request structurally stops a user-controlled key from reaching another user's data.

Requiring explicit access-control decisions on each request blocks unauthorized key-driven access.

Directly requires validation of inputs before they are accepted as resource identifiers.

Enforces information flow rules that block use of untrusted identifiers to reach unauthorized resources.

Least-privilege restrictions limit the scope of data reachable even if a key check is bypassed.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.AA-05 full match
prevents

Enforcing authorization policy and least privilege directly blocks user-controlled key tampering that bypasses access checks.

PR.IR-01 mostly match
prevents

Logical access controls prevent unauthorized data access that results from missing authorization checks on object references.

PR.PS-06 mostly match
prevents

Secure SDLC practices directly require input validation and sanitization that prevent resource-identifier injection flaws.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

finds

Security testing can detect resource-injection flaws but does not itself implement preventive controls.

prevents

Information access restriction explicitly enforces that users may only retrieve data they are authorized to see, directly addressing user-controlled key bypass.

prevents

Access control policy directly requires enforcement of authorization rules that prevent unauthorized access via manipulated keys.

prevents

Managing access rights includes ensuring users can only access their own records and not bypass authorization by altering identifiers.

mitigates

Privileged access rights control restricts what data each user may access, mitigating direct object reference attacks.

prevents

Secure SDLC mandates input validation and resource-identifier sanitization that directly prevents resource injection.

References