Authorization Bypass in Open edX Platform Enables Information Disclosure
CVE-2026-97702
What is CVE-2026-97702?
The Open edX Platform allows users to manage course teams through the API endpoint /api/support/v1/manage_course_team/, which lacks proper authorization checks. This vulnerability enables any authenticated user to query for specific user information using the email, username, or user_id of others, which can expose whether an account is active or inactive based on the API's varied responses. In addition, users with instructor roles can access sensitive course-related data of other users within their organization. This issue highlights significant privacy concerns within online learning environments and has been resolved in the latest platform updates.
Affected Version(s)
openedx-platform >= release/ulmo, < release/ulmo.4 < release/ulmo, release/ulmo.4
openedx-platform >= release/verawood, < release/verawood.1 < release/verawood, release/verawood.1