CVE-2021-36539 | BDVDB-2026-0042 Detail

Description#

Instructure Canvas LMS didn't properly deny access to locked/unpublished files when the unprivileged user access the DocViewer based file preview URL (canvadoc_session_url).

Impact#

No impact statement in the source data.

Weaknesses#

No weakness recorded in the source data.

References#

https://github.com/instructure/canvas-lms/issues/1905
https://github.com/gaukas/instructure-canvas-file-oracle

Exploit#

No public exploit known

History#

Version 12023-01-26Record published in the CVE List.
Version 22024-08-04Most recent update recorded in the CVE List.