CVE-2026-63235: Three Learning Koollab Lms

Low severity, CVSS 3.7. EPSS: 0.3% chance of exploitation in the next 30 days.

An improper access control vulnerability in Koollab LMS allowed an unauthenticated attacker to forcibly terminate the session of any user given their email address via the login kickout endpoint, resulting in a denial of service.

Affected products

• Three Learning Koollab Lms: version 5.3.2 only

Published 2026-07-29. Last modified 2026-07-30.