TI-2020-04287 Aliases CVE-2020-5231 GHSA-94qw-r73x-j7hg

Opencast users with ROLE_COURSE_ADMIN can create new users

LOW 30CWE-285Published 2020-01-30 · Updated 2024-08-04

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: Security bypass
Confidentiality · integrity · availability: None · High · None
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-285.

Summary

In Opencast before 7.6 and 8.1, users with the role ROLE_COURSE_ADMIN can use the user-utils endpoint to create new users not including the role ROLE_ADMIN. ROLE_COURSE_ADMIN is a non-standard role in Opencast which is referenced neither in the documentation nor in any code (except for tests) but only in the security configuration. From the name – implying an admin for a specific course – users would never expect that this role allows user creation. This issue is fixed in 7.6 and 8.1 which both ship a new default security configuration.

Why it matters now

EPSS 0.00625 50th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Fixed opencast (opencast): 7.6, 8.1org.opencastproject:opencast-kernel (Maven): 7.6, 8.1

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
opencast	opencast	before 7.6; 8.0 to before 8.1	7.6, 8.1	Patch available	CNA
—	org.opencastproject:opencast-kernel (Maven)	before 7.6	7.6	Patch available	GHSA-94qw-r73x-j7hg
—	org.opencastproject:opencast-kernel (Maven)	8.0 to before 8.1	8.1	Patch available	GHSA-94qw-r73x-j7hg

opencast Vendoropencast Affected before 7.6; 8.0 to before 8.1 Fixed in 7.6, 8.1 Patch available CNA
org.opencastproject:opencast-kernel (Maven) Vendor— Affected before 7.6 Fixed in 7.6 Patch available GHSA-94qw-r73x-j7hg
org.opencastproject:opencast-kernel (Maven) Vendor— Affected 8.0 to before 8.1 Fixed in 8.1 Patch available GHSA-94qw-r73x-j7hg

CPE configurations NVD · 2

CPE	Versions	Role	Vendor
cpe:2.3:a:apereo:opencast::::::::	before 7.6	Vulnerable	Apereo
cpe:2.3:a:apereo:opencast:8.0:::::::*	8.0	Vulnerable	Apereo

cpe:2.3:a:apereo:opencast:*:*:*:*:*:*:*:* Versions before 7.6 Vulnerable ·Apereo
cpe:2.3:a:apereo:opencast:8.0:*:*:*:*:*:*:* Versions 8.0 Vulnerable ·Apereo

Remediation

Fix · CNA opencast (opencast) Fixed in 7.6, 8.1
Fix · GHSA-94qw-r73x-j7hg org.opencastproject:opencast-kernel (Maven) Fixed in 7.6 Advisory →
Fix · GHSA-94qw-r73x-j7hg org.opencastproject:opencast-kernel (Maven) Fixed in 8.1 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2020-5231
2026-10-03 Alias added: GHSA-94qw-r73x-j7hg
2026-11-03 EPSS moved to the 50th–90th percentile

References

TI-2026-54099 Paella Player: Stored XSS via caption cue text CVSS 3.1HIGH 8.7
TI-2026-54098 Opencast: Session fixation in login enables account takeover via crafted link CVSS 3.1HIGH 8.8
TI-2021-19627 Files Accessible to External Parties in Opencast CVSS 3.1CRITICAL 9.9
TI-2025-38256 Opencast's editor accidentally publishes videos/overwrites publications #1626 CVSS 4.0LOW 2.3
TI-2020-04262 Authentication Bypass For Endpoints With Anonymous Access in OpenCast CVSS 3.1CRITICAL 10.0
TI-2017-14534 Opencast 2.3.2 and older versions are vulnerable to script injections through media and… CVSS 3.0HIGH 8.8

See all 20 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences