Vulnerability · Published Dec 16, 2025 · Assigned by GitHub_M

CVE-2025-68270CourseLimitedStaff Role Allows Studio Access

Critical 9.9

In plain English

A critical-severity missing authorization in edx-platform from openedx. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 25% of all known vulnerabilities).

Severity (CVSS 3.1)9.9Critical

Exploit odds (30 days)0.3%top 74.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

The Open edX Platform is a learning management platform. Prior to commit 05d0d0936daf82c476617257aa6c35f0cd4ca060, CourseLimitedStaffRole users are able to access and edit courses in studio if they are granted the role on an org rather than on a course, and CourseLimitedStaffRole users are able to list courses they have the role on in studio even though they are not meant to have any access on the studio side for the course. Commit 05d0d0936daf82c476617257aa6c35f0cd4ca060 fixes the issue.

Affected products (as reported)

Vendor	Product	Versions
openedx	edx-platform	< 05d0d0936daf82c476617257aa6c35f0cd4ca060

Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L

References

https://github.com/openedx/edx-platform/security/advisories/GHSA-rh64-vc2h-7wfj x_refsource_CONFIRM
https://github.com/openedx/edx-platform/pull/37772 x_refsource_MISC
https://github.com/openedx/edx-platform/pull/37773 x_refsource_MISC
https://github.com/openedx/edx-platform/commit/05d0d0936daf82c476617257aa6c35f0cd4ca060 x_refsource_MISC