Email Spoofing Vulnerability in Open edX Platform by Open edX
CVE-2026-85271

6.1MEDIUM

Key Information:

Vendor

Openedx

Status
Openedx-platform
Vendor
CVE Published:
18 September 2026

What is CVE-2026-85271?

The Open edX Platform has a vulnerability that allows an attacker to exploit the email notification system. Specifically, in versions from Redwood to Ulmo and Verawood.1, the add_additional_attributes_to_notifications function fails to properly sanitize discussion-title values. This lack of validation can lead to CSS-capable markup being inserted by enrolled students, enabling email open tracking and phishing attempts through malicious content. The vulnerability is mitigated in the latest releases: Ulmo and Verawood.1.

Affected Version(s)

openedx-platform >= release/redwood.1, < release/ulmo.4

References

https://github.com/openedx/openedx-platform/security/advi...
x_refsource_CONFIRM
https://github.com/openedx/openedx-platform/commit/2af03d...
x_refsource_MISC
https://github.com/openedx/openedx-platform/commit/52f2b3...
x_refsource_MISC

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.