Read the docs
TI-2025-38256 Aliases CVE-2025-61906

Opencast's editor accidentally publishes videos/overwrites publications #1626

Priority MEDIUM 45CWE-200Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
Information disclosure
Confidentiality · integrity · availability
Low · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-200.

Summary

Opencast is a free, open-source platform to support the management of educational audio and video content. Prior to Opencast 17.8 and 18.2, in some situations, Opencast's editor may publish a video without notifying the user. This may lead to users accidentally publishing media not meant for publishing, and thus possibly exposing internal media. This risk of this actually impacting someone is very low, though. This can only be triggered by users with write access to an event. They also have to use the editor, which is usually an action taken if they want to publish media and not something users would use on internal media they do not want to publish. Finally, they have to first click on "Save & Publish" before then selecting the "Save" option. Nevertheless, while very unlikely, this can happen. This issue is fixed in Opencast 17.8 and 18.2.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00301 22nd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed opencast (opencast): 17.8, 18.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
opencastopencastbefore 17.8; 18.0 to before 18.217.8, 18.2Patch availableCNA
  • opencast Vendoropencast Affected before 17.8; 18.0 to before 18.2 Fixed in 17.8, 18.2 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:apereo:opencast:*:*:*:*:*:*:*:*before 17.8; 18.0 to before 18.2VulnerableApereo
  • cpe:2.3:a:apereo:opencast:*:*:*:*:*:*:*:* Versions before 17.8; 18.0 to before 18.2 Vulnerable ·Apereo

Remediation

  • Fix · CNA opencast (opencast) Fixed in 17.8, 18.2

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-61906

References

Exploit 1

Patch 1

Advisory 1

  • TI-2026-54099 Paella Player: Stored XSS via caption cue text CVSS 3.1HIGH 8.7
  • TI-2026-54098 Opencast: Session fixation in login enables account takeover via crafted link CVSS 3.1HIGH 8.8
  • TI-2021-19627 Files Accessible to External Parties in Opencast CVSS 3.1CRITICAL 9.9
  • TI-2020-04262 Authentication Bypass For Endpoints With Anonymous Access in OpenCast CVSS 3.1CRITICAL 10.0
  • TI-2017-14534 Opencast 2.3.2 and older versions are vulnerable to script injections through media and… CVSS 3.0HIGH 8.8
  • TI-2020-04278 Hard-Coded Key Used For Remember-me Token in OpenCast CVSS 3.1HIGH 8.8
See all 20 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences