← Database

CVE-2021-36539

MEDIUM CVSS: 6.5 Published: 2023-01-26 Modified: 2026-06-17

Description

Instructure Canvas LMS didn't properly deny access to locked/unpublished files when the unprivileged user access the DocViewer based file preview URL (canvadoc_session_url).

Affected Platforms

Instructure Canvas Learning Management Service

Weakness Type

CWE-639

References