Vulnerability · Published Sep 2, 2026 · Assigned by GitHub_M

CVE-2026-53635Open edX Platform: Insufficient Permission on set_course_mode_price()

High 7.6

In plain English

A high-severity missing authorization in openedx-platform from openedx. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 34% of all known vulnerabilities).

Severity (CVSS 3.1)7.6High

Exploit odds (30 days)0.4%top 65.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Open edX Platform enables the authoring and delivery of online learning at any scale. Prior to commit 59bb6d6, the view function set_course_mode_price() at lms/djangoapps/instructor/views/instructor_dashboard.py:430 is decorated only with @login_required and performs no course-level permission check. Any authenticated user — including a learner account with zero course roles — can issue a single POST request to overwrite the honor mode price and currency of any course on the platform. The companion frontend modal was removed in a prior cleanup, but the URL route and view remain live, making this an unguarded orphan endpoint. This issue has been patched via commit 59bb6d6.

Affected products (as reported)

Vendor	Product	Versions
openedx	openedx-platform	< 59bb6d669e4fdc24d96afb809e12119372d9e257

Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L

References

https://github.com/openedx/openedx-platform/security/advisories/GHSA-rqq6-w4pv-7pjv x_refsource_CONFIRM
https://github.com/openedx/openedx-platform/commit/59bb6d669e4fdc24d96afb809e12119372d9e257 x_refsource_MISC
https://github.com/openedx/openedx-platform/commit/f25bbc4d52bd827c8f04c73de427e2e16a144c73 x_refsource_MISC
https://github.com/openedx/openedx-platform/commit/fd93ef5f9940f4ad6f50cf7faecad8d9cf2d3336 x_refsource_MISC