The classifier judged this item not relevant to AI security, so it is left out of lists, feeds, the API and dataset releases. If that is wrong, report a correction on this page.
CVE-2026-97702: Open edX Platform enables the authoring and delivery of online learning at any scale. From the Ulmo release until…
- Source
- NVD(opens in a new tab)
- Identifier
- CVE-2026-97702
- Published
- Record updated
- Known exploitation
- Not listed in the CISA Known Exploited Vulnerabilities catalog at the last check.
Summary
Open edX Platform, from the Ulmo release until release/ulmo.4 and release/verawood.1, exposes GET /api/support/v1/manage_course_team/ in CourseTeamManageAPIView with only IsAuthenticated, omitting the global support-role check. Any authenticated learner can query arbitrary targets by email, username or user_id and tell active accounts from absent or inactive ones through the 200 and 404 response difference. Callers with a course-level or organization-level instructor role can also read the target's staff or instructor assignments within their own scope.
Mitigation
Fixed in release/ulmo.4 and release/verawood.1.