Read the docs
TI-2026-38679 Aliases CVE-2026-53635

Open edX Platform: Insufficient Permission on set_course_mode_price()

Priority HIGH 66CWE-862Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
Low · High · Low
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-862.

Summary

Open edX Platform enables the authoring and delivery of online learning at any scale. Prior to commit 59bb6d6, the view function set_course_mode_price() at lms/djangoapps/instructor/views/instructor_dashboard.py:430 is decorated only with @login_required and performs no course-level permission check. Any authenticated user — including a learner account with zero course roles — can issue a single POST request to overwrite the honor mode price and currency of any course on the platform. The companion frontend modal was removed in a prior cleanup, but the URL route and view remain live, making this an unguarded orphan endpoint. This issue has been patched via commit 59bb6d6.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00397 34th percentileScored 2026-11-07
Fix Fixed openedx-platform (openedx): 59bb6d669e4fdc24d96afb809e12119372d9e257

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
openedxopenedx-platformbefore 59bb6d669e4fdc24d96afb809e12119372d9e25759bb6d669e4fdc24d96afb809e12119372d9e257Patch availableCNA
  • openedx-platform Vendoropenedx Affected before 59bb6d669e4fdc24d96afb809e12119372d9e257 Fixed in 59bb6d669e4fdc24d96afb809e12119372d9e257 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:openedx:openedx:*:*:*:*:*:*:*:*——openedx
  • cpe:2.3:a:openedx:openedx:*:*:*:*:*:*:*:* Versions — — ·openedx

Remediation

  • Fix · CNA openedx-platform (openedx) Fixed in 59bb6d669e4fdc24d96afb809e12119372d9e257

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-53635

References

Other 4

  • TI-2026-31065 Open edX Platform: Server-Side Request Forgery (SSRF) in SAML Provider Data Sync Endpoint CVSS 3.1CRITICAL 9.9
  • TI-2022-22791 Drag and Drop XBlock v2 has XSS Issues in Xblock Input Fields CVSS 3.1HIGH 8.4
  • TI-2026-31067 Open edx Enterprise Service: SSRF via SAML metadata URL in sync_provider_data endpoint CVSS 3.1HIGH 8.5
  • TI-2026-26980 Open edX Platform: Account Activation Bypass via activation_key Exposure in REST API CVSS 3.1MEDIUM 5.3
  • TI-2026-27540 Open edX Platform has an Open Redirect in Survey Views via Unvalidated redirect_url Parameter CVSS 3.1MEDIUM 6.1
  • TI-2026-31064 Open edX Platform: Stored CSS Injection in Email Notifications via Incomplete HTML Sanitization CVSS 3.1MEDIUM 5.4
See all 17 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences