CVE-2021-36539
Instructure Canvas LMS didn't properly deny access to locked/unpublished files when the...
Instructure Canvas LMS didn't properly deny access to locked/unpublished files when the unprivileged user access the DocViewer based file preview URL (canvadoc_session_url).
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
Instructure Canvas LMS didn't properly deny access to locked/unpublished files when the unprivileged user access the DocViewer based file preview URL (canvadoc_session_url).
- Record
CVE-2021-36539- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-639
- Updated
- 2026-11-02
CVE List No score
Instructure Canvas LMS didn't properly deny access to locked/unpublished files when the unprivileged user access the DocViewer based file preview URL (canvadoc_session_url).
- Record
CVE-2021-36539- Updated
- 2026-11-02
EUVDEUVD-2021-23141 No score
Instructure Canvas LMS didn't properly deny access to locked/unpublished files when the unprivileged user access the DocViewer based file preview URL (canvadoc_session_url).
- Record
EUVD-2021-23141- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-pw89-gxgv-mjvm
Instructure Canvas LMS didn't properly deny access to locked/unpublished files when the...
Instructure Canvas LMS didn't properly deny access to locked/unpublished files when the unprivileged user access the DocViewer based file preview URL (canvadoc_session_url).
- Record
GHSA-pw89-gxgv-mjvm- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-200, CWE-639
- Updated
- 2026-11-02
OSVBIT-canvaslms-2021-36539 No score
Instructure Canvas LMS didn't properly deny access to locked/unpublished files when the unprivileged user access the DocViewer based file preview URL (canvadoc_session_url).
- Record
BIT-canvaslms-2021-36539- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
canvaslmsBitnami |
before 2022-10-15.0.0 | 2022-10-15.0.0 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2021-36539 is a medium vulnerability (CVSS 6.5) in Instructure Canvas Learning Management Service, published January 26, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.90%, the 60th percentile. Fixed in canvaslms 2022-10-15.0.0.