Vulnerabilities

TI-2026-58536 CVE-2026-85210 · GHSA-3pm4-cw53-2cg9

Oppia through 3.5.2 Missing Authorization on AdminRoleHandler GET

MEDIUM 57

Oppia's AdminRoleHandler GET endpoint in core/controllers/admin.py is decorated with open_access, allowing any registered user to enumerate privileged accounts and roles.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00342 Published 2026-09-03 No fix listed CWE-862

TI-2023-20911 CVE-2023-40021

Timing Attack Reveals CSRF Tokens in oppia

MEDIUM 57

Oppia is an online learning platform.

CVSS 3.1MEDIUM 5.3 Network No auth User interaction EPSS 0.00774 Published 2023-08-16 Fixed in 3.3.2-hotfix-2 CWE-203

TI-2021-18392 CVE-2021-41733 · GHSA-rxgx-ggx4-6jr5

Oppia 3.1.4 does not verify that certain URLs are valid before navigating to them.

LOW 29

Oppia 3.1.4 does not verify that certain URLs are valid before navigating to them.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00742 Published 2021-11-08 No fix listed CWE-601

Vulnerabilities

Filters

Oppia through 3.5.2 Missing Authorization on AdminRoleHandler GET

Timing Attack Reveals CSRF Tokens in oppia

Oppia 3.1.4 does not verify that certain URLs are valid before navigating to them.