jvr2022/cve-2026-25126Proof-of-concept for CVE-2026-25126 demonstrating vote count manipulation in PolarLearn via improper runtime validation of the forum vote direction parameter, with fix details.
Research: Joshua van Rijswijk
PoC for CVE-2026-25126, a high-severity business logic vulnerability in the PolarLearn forum voting API.
The endpoint POST /api/v1/forum/vote fails to enforce strict runtime validation of the direction field.
Because TypeScript types are not enforced at runtime, an attacker can send arbitrary strings which are incorrectly handled downstream.
This allows manipulation of vote counts by creating so-called ghost downvotes.
The API trusts the JSON body without validation:
const body: VoteRequestBody = await request.json()
const { postId, direction } = body
const result = await VoteServer(postId, direction)
Downstream logic treats any unexpected non-null value as a downvote, and persists invalid values.
By alternating an invalid vote with a null reset, a single user can repeatedly decrement the vote count.
fetch support)git clone https://github.com/<your-username>/CVE-2026-25126-PoC.git
cd CVE-2026-25126-PoC
Open poc.js and replace:
POST_ID with the target forum post IDCOOKIE with your authenticated session cookienode poc.js
After each cycle, the vote count should decrease incorrectly. Refresh the forum page to confirm the manipulated score.
Patched by implementing strict runtime validation:
"up", "down", or null