Medium severity · published Feb 9, 2026
CVE-2026-24900
MarkUs has a submission-view IDOR exposes all student submissions
6.5
CVSS
0.3%
EPSS
No
On KEV
Description
MarkUs is a web application for the submission and grading of student assignments. Prior to 2.9.1, the courses/<:course_id>/assignments/<:assignment_id>/submissions/html_content accepted a select_file_id parameter to serve SubmissionFile objects containing a record of files submitted by students. This parameter was not correctly scoped to the requesting user, allowing users access arbitrary submission file contents by id. This vulnerability is fixed in 2.9.1.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 22% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MA
Markus · MarkUsProject
< 2.9.1 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-24900
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-24900
Patch
https://github.com/MarkUsProject/Markus/commit/7daed9fd2d44932223798d997b55094a3bff104b
Product
https://github.com/MarkUsProject/Markus/releases/tag/v2.9.1
Vendor Advisory
https://github.com/MarkUsProject/Markus/security/advisories/GHSA-56gh-8hmq-7q88
More from Markus
9.1
CVE-2026-25057
Zip Slip in MarkUs config upload allowing RCE
8.8
CVE-2024-51743
MarkUs is a web application for the submission and grading of student assignments
8.8
CVE-2024-51499
MarkUs is a web application for the submission and grading of student assignments
6.5
CVE-2026-25962
MarkUs: Zip bomb in config upload enables DoS
5.4
CVE-2026-28405
MarkUs: Stored XSS in Submission HTML Preview Enables Instructor-Context Actions