CVE-2026-97702

Open edX: Support "manage_course_team" REST API omits the `require_support_permission` gate its sibling support views enforce

Products / packages openedx-platform

Published 04/11/2026, 22:51:25 UTC

Severity and exploitation

Not in CISA KEV

KEV coverage does not rule out exploitation.

KEV checked 14/11/2026, 21:05:32 UTC

GitHub_M · CVSS:3.1 · 5.3

Assessment vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Severity

medium5.3

CVSS measures technical severity, not the likelihood of an attack.

Known exploitation

Not listed in the checked CISA KEV catalog

Absence from CISA KEV does not rule out attacks.

Public exploit

Exploit reference published

Source-linked evidence; not proof of attacks in the wild or independent validation.

Remediation

Fix status not established

No structured fix or guidance is available here. Check the latest publisher advisory.

What this means

Open edX Platform versions from Ulmo to ulmo.4 and verawood to verawood.1 have a vulnerability where the manage_course_team REST API lacks a support permission check, allowing authenticated learners to distinguish active accounts and instructors to obtain staff assignments. Anonymous callers are blocked. The issue is fixed in ulmo.4 and verawood.1.

Summarized by @cf/meta/llama-3.3-70b-instruct-fp8-fast. Verify details against the original sources.

Attack conditions

From the Ulmo release until release/ulmo.4 and release/verawood.1, the GET /api/support/v1/manage_course_team/ endpoint in CourseTeamManageAPIView requires only IsAuthenticated and omits the global support-role authorization check intended for this help-desk surface.

Excerpt from the original source description below.

Review supporting sources →

Affected versions

Check the exact model, release, and any platform requirements against your installation.

openedx · GitHub_M

openedx-platform

2 ranges

GitHub_M version evidence

Check a product version

Compare with this publisher’s ranges. This does not inspect your installation.

affected

>= release/ulmo, < release/ulmo.4

>= release/verawood, < release/verawood.1

Other versions: unknown

Automatic dependency matching is unavailable for this record. Use the product evidence and publisher’s instructions to check your installation.

What to do

Compare your installed product and version with the affected versions above. A matching product name alone does not confirm exposure.

No structured fix or remediation guidance is available here. Check the full source description and vendor’s latest advisory for a patch or workaround; do not assume another version is safe.

cve.new guidance unless attributed to a publisher. This page does not inspect your installation.

Public exploit evidence

The sources identify public exploit references. We have not independently tested them; their availability does not establish exploitation in the wild.

wazuh/wazuh · security/advisories/GHSA-whhr-gxxr-f6pm ↗Attributed to CISA-ADP

Original source description

Read the full publisher description

Open edX Platform enables the authoring and delivery of online learning at any scale. From the Ulmo release until release/ulmo.4 and release/verawood.1, the GET /api/support/v1/manage_course_team/ endpoint in CourseTeamManageAPIView requires only IsAuthenticated and omits the global support-role authorization check intended for this help-desk surface. Any authenticated learner can supply an email, username, or user_id for an arbitrary target and use the 200 and 404 response discrepancy to distinguish an active account from an absent or inactive account. A caller with a course-level or organization-level instructor role can additionally obtain the target user's staff or instructor assignments within the caller's course or organization scope. Anonymous callers remain blocked, and the separately authorized PUT behavior is outside this vulnerability. This issue is fixed in release/ulmo.4 and release/verawood.1.

References

6 sources

openedx/openedx-platform · security/advisories/GHSA-95xv-3c54-c3pw

Security advisoryGitHub_M

openedx/openedx-platform · commit 46c5435

PatchGitHub_M

openedx/openedx-platform · commit e2a1215

PatchGitHub_M

openedx/openedx-platform · releases/tag/release/ulmo.4

Release notesGitHub_M

openedx/openedx-platform · releases/tag/release/verawood.1

Release notesGitHub_M

wazuh/wazuh · security/advisories/GHSA-whhr-gxxr-f6pm

Public exploit referenceCISA-ADP

Inside the record

Evidence available

Package identity · not supplied

Version evidence

Remediation guidance · not supplied

Weakness classification

Additional publishers

Describes the evidence in this view, not whether the product is safe.

Original records

CVE-2026-97702

View the latest unmodified CVE JSON from the official source. It may be newer than this imported page.

cve.new JSON →

Underlying weaknesses

The source’s classification of what caused the vulnerability.

CWE-204 ↗

CWE-204: Observable Response Discrepancy

GitHub_M

CWE-862 ↗

CWE-862: Missing Authorization

GitHub_M

Contributing organizations · 2

GitHub_M

Assigning organization

2026-11-04

CISA-ADP

Additional data publisher

2026-11-09

Timeline

All times UTC

4 Nov 2026, 22:51
Advisory published
Publication date supplied by the source.
9 Nov 2026, 22:02
Source updated
Latest modification date supplied by the source.
9 Nov 2026, 22:21
Last imported by cve.new
Latest catalog import, not the date we first saw this advisory.

What changed

Follow changes

CVE · CVE-2026-977022026-11-09

Observed 2026-11-09T22:21:51.319Z · upstream updated 2026-11-09T22:02:01.367Z

References changed

before

[
  "https://github.com/openedx/openedx-platform/security/advisories/GHSA-95xv-3c54-c3pw",
  "https://github.com/openedx/openedx-platform/commit/46c543590c78aa1bfa846d47a4f1c5c6ec388490",
  "https://github.com/openedx/openedx-platform/commit/e2a1215f8d5da5170ddbf10316c2362e965e17bc",
  "https://github.com/openedx/openedx-platform/releases/tag/release/ulmo.4",
  "https://github.com/openedx/openedx-platform/releases/tag/release/verawood.1"
]

after

[
  "https://github.com/openedx/openedx-platform/security/advisories/GHSA-95xv-3c54-c3pw",
  "https://github.com/openedx/openedx-platform/commit/46c543590c78aa1bfa846d47a4f1c5c6ec388490",
  "https://github.com/openedx/openedx-platform/commit/e2a1215f8d5da5170ddbf10316c2362e965e17bc",
  "https://github.com/openedx/openedx-platform/releases/tag/release/ulmo.4",
  "https://github.com/openedx/openedx-platform/releases/tag/release/verawood.1",
  "https://github.com/wazuh/wazuh/security/advisories/GHSA-whhr-gxxr-f6pm"
]

Prioritization updated

before

[]

after

[
  {
    "source": "CISA-ADP",
    "type": "SSVC",
    "role": "CISA Coordinator",
    "timestamp": "2026-11-09T22:00:52.528201Z",
    "decisions": [
      {
        "name": "Exploitation",
        "value": "poc"
      },
      {
        "name": "Automatable",
        "value": "yes"
      },
      {
        "name": "Technical Impact",
        "value": "partial"
      }
    ]
  }
]

Large field values are marked as truncated previews. Original source snapshots remain retained.

Showing up to 50 most recent observed changes.

Reading the signals

Severity · CVSS: Technical impact and attack conditions. The headline is the highest imported catalog score; sources may disagree.
Observed exploitation · KEV: An absent or unavailable KEV listing does not establish that exploitation has not occurred.
Predicted exploitation · EPSS: No EPSS estimate available in this record.

CISA-ADP · SSVC

CISA Coordinator · 2026-11-09

Exploitation: poc
Automatable: yes
Technical Impact: partial

SSVC describes the publisher’s decision context. Your organization’s exposure and priorities may differ.

Record identifiers

Aliases: None recorded

Source evidence

Request a correction or dispute

Start with the assigning organization for this record. Include the CVE ID, the disputed information, and supporting evidence. A dispute does not itself reject a record.

Find the responsible CNA →Official dispute and escalation process ↗

CVE CVE-2026-97702

Enrichment coverage

NVDAvailable

Checked 05/11/2026, 02:30:38 UTC

GHSANo result

Checked 05/11/2026, 02:30:38 UTC

EUVDAvailable

Checked 05/11/2026, 02:30:40 UTC

EPSSNo result

Checked 05/11/2026, 02:30:37 UTC

Additional source evidence

NVD · CVE-2026-97702

CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Checked 05/11/2026, 02:30:38 UTC

ENISA EUVD · EUVD-2026-117191

CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Checked 05/11/2026, 02:30:40 UTC

Sponsored by MoxsoBuild security habits with adaptive training and phishing simulations.View as JSON

Investigate in your agent.

Open edX: Support "manage_course_team" REST API omits the `require_support_permission` gate its sibling support views enforce

Severity and exploitation

What this means

Attack conditions

Affected versions

openedx-platform

affected

unaffected

unknown

What to do

Public exploit evidence

Original source description

References

Inside the record

Evidence available

Original records

Underlying weaknesses

Timeline

Advisory published

Source updated

Last imported by cve.new

What changed