A pre-authentication error-based SQL injection vulnerability was discovered in Koollab LMS. The flaw allows unauthenticated attackers to read sensitive database contents via the SCORM report endpoint. Exposed data includes personally identifiable information, user credentials, and valid JWT tokens. Successful exploitation of leaked JWT tokens could enable full account takeover. No authentication is required to exploit the vulnerability, significantly increasing its risk. The vulnerability has been assigned CVE-2026-63230 and is rated high severity. Advisories have been issued by both NVD/NIST and the Cyber Security Agency of Singapore (CSA).