Missing support permission check in Open edX course team API
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure, Security bypass
- Confidentiality · integrity · availability
- Low · None · None
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-204 and CWE-862.
Summary
Open edX Platform from release/ulmo before release/ulmo.4 and from release/verawood before release/verawood.1 is affected. The GET /api/support/v1/manage_course_team/ endpoint lacks the support-role check that its sibling views enforce (CWE-862). Any authenticated learner can tell active accounts from absent ones by a 200 and 404 response difference. Course or organization instructors can also read a target's staff or instructor assignments within their own scope.
Written with Claude Haiku 5.5 from the sources below · 2026-11-04
Description from the CNA
Open edX Platform enables the authoring and delivery of online learning at any scale. From the Ulmo release until release/ulmo.4 and release/verawood.1, the GET /api/support/v1/manage_course_team/ endpoint in CourseTeamManageAPIView requires only IsAuthenticated and omits the global support-role authorization check intended for this help-desk surface. Any authenticated learner can supply an email, username, or user_id for an arbitrary target and use the 200 and 404 response discrepancy to distinguish an active account from an absent or inactive account. A caller with a course-level or organization-level instructor role can additionally obtain the target user's staff or instructor assignments within the caller's course or organization scope. Anonymous callers remain blocked, and the separately authorized PUT behavior is outside this vulnerability. This issue is fixed in release/ulmo.4 and release/verawood.1.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| openedx | openedx-platform | >= release/ulmo, < release/ulmo.4; >= release/verawood, < release/verawood.1 | — | No fix listed | CNA |
- openedx-platform Vendoropenedx Affected >= release/ulmo, < release/ulmo.4; >= release/verawood, < release/verawood.1 Fixed in — No fix listed CNA
Remediation
Upgrade to release/ulmo.4 for the Ulmo line or release/verawood.1 for the Verawood line, which fix this issue.
Written with Claude Haiku 5.5 from the sources below · 2026-11-04
Timeline
- 2026-11-04 Threatist record created from CVE-2026-97702
References
Other 5
- https://github.com/openedx/openedx-platform/security/advisories/GHSA-95xv-3c54-c3pw
- https://github.com/openedx/openedx-platform/commit/46c543590c78aa1bfa846d47a4f1c5c6ec388490
- https://github.com/openedx/openedx-platform/commit/e2a1215f8d5da5170ddbf10316c2362e965e17bc
- https://github.com/openedx/openedx-platform/releases/tag/release/ulmo.4
- https://github.com/openedx/openedx-platform/releases/tag/release/verawood.1
More openedx vulnerabilities
- TI-2026-31065 Open edX Platform: Server-Side Request Forgery (SSRF) in SAML Provider Data Sync Endpoint CVSS 3.1CRITICAL 9.9
- TI-2022-22791 Drag and Drop XBlock v2 has XSS Issues in Xblock Input Fields CVSS 3.1HIGH 8.4
- TI-2026-31067 Open edx Enterprise Service: SSRF via SAML metadata URL in sync_provider_data endpoint CVSS 3.1HIGH 8.5
- TI-2026-38679 Open edX Platform: Insufficient Permission on set_course_mode_price() CVSS 3.1HIGH 7.6
- TI-2026-26980 Open edX Platform: Account Activation Bypass via activation_key Exposure in REST API CVSS 3.1MEDIUM 5.3
- TI-2026-27540 Open edX Platform has an Open Redirect in Survey Views via Unvalidated redirect_url Parameter CVSS 3.1MEDIUM 6.1
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences