Koollab LMS Stored XSS Vulnerability CVE-2026-3007
Summary
CSA has assigned CVE-2026-3007 to a stored cross-site scripting (XSS) vulnerability in Koollab Learning Management System version 5.3.2, reported under CSA's Responsible Vulnerability Disclosure Policy. The product owner, Three Learning, has released security update version 5.4.0 to address the flaw. Successful exploitation could allow an attacker to execute arbitrary JavaScript on any user account with access to Koollab LMS' courselet feature.
“Successful exploitation of the stored cross-site scripting (XSS) vulnerability could allow an attacker to execute arbitrary JavaScript on any user account that has access to Koollab LMS' courselet feature.”
About this source
GovPing monitors CSA Alerts & Advisories (Singapore) for new data privacy & cybersecurity regulatory changes. Every update since tracking began is archived, classified, and available as free RSS or email alerts — 32 changes logged to date.
What changed
CSA has issued CVE-2026-3007 for a stored XSS vulnerability in Koollab LMS version 5.3.2. The vulnerability affects the courselet feature and could allow an attacker to execute arbitrary JavaScript on any user account with access. Three Learning, the product owner, has released version 5.4.0 as a security update.\n\nOrganisations using Koollab LMS should apply the security update without delay and review access controls for the courselet feature. Administrators should monitor for any signs of exploitation and consider whether user accounts may have been compromised prior to patching.
What to do next
- Update to version 5.4.0 immediately
Archived snapshot
Apr 23, 2026GovPing captured this document from the original source. If the source has since changed or been removed, this is the text as it existed at that time.
Alerts
Vulnerability in Koollab Learning Management System (LMS)
23 April 2026
CSA has issued a CVE ID to a vulnerability reported in Koollab LMS as part of CSA’s Responsibility Vulnerability Disclosure Policy. Users and administrators of the affected product version are advised to update to the latest version 5.4.0 immediately.
Background
CSA has issued a CVE ID (CVE-2026-3007) to a vulnerability reported in Koollab LMS. The Product Owner, Three Learning, an e-learning service provider, has released a security update to address it.
Impact
Successful exploitation of the stored cross-site scripting (XSS) vulnerability could allow an attacker to execute arbitrary JavaScript on any user account that has access to Koollab LMS’ courselet feature.
Affected Products
The vulnerability affects Koollab LMS version 5.3.2.
Mitigation
Users and administrators of the affected product version are advised to update to the latest version 5.4.0 immediately.
Special Thanks to:
- Informer: Mr Justin Ng, CSA
- Product Owner: Three Learning
Parties
Related changes
Get daily alerts for CSA Alerts & Advisories (Singapore)
Daily digest delivered to your inbox.
Free. Unsubscribe anytime.
Source
About this page
Every important government, regulator, and court update from around the world. One place. Real-time. Free. Our mission
Source document text, dates, docket IDs, and authority are extracted directly from CSA.
The summary, classification, recommended actions, deadlines, and penalty information are AI-generated from the original text and may contain errors. Always verify against the source document.
Classification
Who this affects
Taxonomy
Browse Categories
Get alerts for this source
We'll email you when CSA Alerts & Advisories (Singapore) publishes new changes.
Subscribed!
Optional. Filters your digest to exactly the updates that matter to you.