CVE-2026-53635 Details
Description
Open edX Platform enables the authoring and delivery of online learning at any scale. Prior to commit 59bb6d6, the view function set_course_mode_price() at lms/djangoapps/instructor/views/instructor_dashboard.py:430 is decorated only with @login_required and performs no course-level permission check. Any authenticated user — including a learner account with zero course roles — can issue a single POST request to overwrite the honor mode price and currency of any course on the platform. The companion frontend modal was removed in a prior cleanup, but the URL route and view remain live, making this an unguarded orphan endpoint. This issue has been patched via commit 59bb6d6.
A privilege escalation vulnerability exists in the Open edX Platform within the course management feature. The issue arises in the 'set_course_mode_price' view, located in 'lms/djangoapps/instructor/views/instructor_dashboard.py', prior to commit '59bb6d6'. This view is only protected by a login requirement, allowing any authenticated user, including those with no course roles, to send a POST request and change the honor mode price and currency for any course. The vulnerability is exacerbated by the removal of the corresponding frontend modal, leaving the endpoint unprotected and accessible. The issue has been addressed in versions 'ulmo' and 'verawood'.
Users can update to Open edX Platform versions 'ulmo' or 'verawood' to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 2, 2026CISA-ADP
Assessed Sep 2, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/openedx/openedx-platform/security/advisories/GHSA-rqq6-w4pv-7pjv | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/openedx/openedx-platform/commit/59bb6d669e4fdc24d96afb809e12119372d9e257 | [email protected] | Source CodeVendor |
| https://github.com/openedx/openedx-platform/commit/f25bbc4d52bd827c8f04c73de427e2e16a144c73 | [email protected] | Source CodeVendor |
| https://github.com/openedx/openedx-platform/commit/fd93ef5f9940f4ad6f50cf7faecad8d9cf2d3336 | [email protected] | Source CodeVendor |
| https://github.com/openedx/openedx-platform/security/advisories/GHSA-rqq6-w4pv-7pjv | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-862 | Missing Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Open edX | >= aspen.1 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 2, 2026 | CVE Modified | CISA-ADP |
| Sep 2, 2026 | New CVE Received | [email protected] |