A vulnerability in the PolarLearn vote API allows authenticated users to manipulate vote data, posing a risk to application integrity.

This is an improper input validation flaw (CWE-20) located in the POST /api/v1/forum/vote endpoint. The application fails to enforce runtime type validation on the direction field, allowing any authenticated user to submit arbitrary strings that are subsequently persisted in the database.

Successful exploitation permits an attacker to corrupt voting data and bypass established business logic within the learning platform. Given the CVSS score of 7.1, this vulnerability represents a significant risk to the reliability and integrity of user-generated metrics, potentially leading to the manipulation of forum content or administrative decisions based on flawed data.

Immediate Action: Update the PolarLearn application to version 0-PRERELEASE-15 or later to implement strict runtime validation for the vote API.

Proactive Monitoring: Review forum activity logs for anomalous entries in the votes_data table, specifically looking for string values in the direction field that do not align with expected inputs.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to inspect and block POST requests to /api/v1/forum/vote where the direction parameter contains unexpected data types or non-standard characters.

Public Exploit Available: Yes, a public proof-of-concept repository exists on GitHub (https://github.com/Jvr2022/CVE-2026-25126).

The vulnerability in PolarLearn presents a clear risk to data integrity that can be exploited by any authenticated user. Organizations utilizing this software should prioritize the deployment of version 0-PRERELEASE-15 to ensure that input validation is properly enforced at the API layer. Applying this update is essential to prevent unauthorized manipulation of application state and to maintain the stability of the platform.