Read the docs
TI-2025-41846 Aliases CVE-2025-68270

CourseLimitedStaff Role Allows Studio Access

Priority MEDIUM 42CWE-862Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · Low
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-862.

Summary

The Open edX Platform is a learning management platform. Prior to commit 05d0d0936daf82c476617257aa6c35f0cd4ca060, CourseLimitedStaffRole users are able to access and edit courses in studio if they are granted the role on an org rather than on a course, and CourseLimitedStaffRole users are able to list courses they have the role on in studio even though they are not meant to have any access on the studio side for the course. Commit 05d0d0936daf82c476617257aa6c35f0cd4ca060 fixes the issue.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00321 25th percentileScored 2026-11-07
Fix Fixed edx-platform (openedx): 05d0d0936daf82c476617257aa6c35f0cd4ca060

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
openedxedx-platformbefore 05d0d0936daf82c476617257aa6c35f0cd4ca06005d0d0936daf82c476617257aa6c35f0cd4ca060Patch availableCNA
  • edx-platform Vendoropenedx Affected before 05d0d0936daf82c476617257aa6c35f0cd4ca060 Fixed in 05d0d0936daf82c476617257aa6c35f0cd4ca060 Patch available CNA

Remediation

  • Fix · CNA edx-platform (openedx) Fixed in 05d0d0936daf82c476617257aa6c35f0cd4ca060

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-68270

References

Other 4

  • TI-2026-31065 Open edX Platform: Server-Side Request Forgery (SSRF) in SAML Provider Data Sync Endpoint CVSS 3.1CRITICAL 9.9
  • TI-2022-22791 Drag and Drop XBlock v2 has XSS Issues in Xblock Input Fields CVSS 3.1HIGH 8.4
  • TI-2026-31067 Open edx Enterprise Service: SSRF via SAML metadata URL in sync_provider_data endpoint CVSS 3.1HIGH 8.5
  • TI-2026-38679 Open edX Platform: Insufficient Permission on set_course_mode_price() CVSS 3.1HIGH 7.6
  • TI-2026-26980 Open edX Platform: Account Activation Bypass via activation_key Exposure in REST API CVSS 3.1MEDIUM 5.3
  • TI-2026-27540 Open edX Platform has an Open Redirect in Survey Views via Unvalidated redirect_url Parameter CVSS 3.1MEDIUM 6.1
See all 17 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences