Vulnerability · Published Feb 3, 2026 · Assigned by GitHub_M
CVE-2026-24668Open eClass Broken Access Control Allows Students to Add Content to Course Units
Medium 6.5
In plain English
A medium-severity improper access control in openeclass from gunet. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 16% of all known vulnerabilities).
Severity (CVSS 3.1)6.5Medium
Exploit odds (30 days)0.2%top 84.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
The Open eClass platform (formerly known as GUnet eClass) is a complete course management system. Prior to version 4.2, a broken access control vulnerability allows authenticated students to add content to existing course units, an action normally restricted to higher-privileged roles. This issue has been patched in version 4.2.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| gunet | openeclass | < 4.2 |
Weakness: CWE-284 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
References
- https://github.com/gunet/openeclass/security/advisories/GHSA-22cq-9fr7-fq6v x_refsource_CONFIRM