CVE-2021-36539: Instructure Canvas Learning Management Service

Medium severity, CVSS 6.5. EPSS: 0.9% chance of exploitation in the next 30 days.

Instructure Canvas LMS didn't properly deny access to locked/unpublished files when the unprivileged user access the DocViewer based file preview URL (canvadoc_session_url).

Affected products

• Instructure Canvas Learning Management Service: before 2022-10-15 (fixed in 2022-10-15)

Published 2023-01-26. Last modified 2026-06-17.