CVE-2026-97702

Received Received - Intake

Information Disclosure in Open edX Platform

Publication date: 2026-11-04

Last updated on: 2026-11-04

Assigner: GitHub, Inc.

Description

Open edX Platform enables the authoring and delivery of online learning at any scale. From the Ulmo release until release/ulmo.4 and release/verawood.1, the GET /api/support/v1/manage_course_team/ endpoint in CourseTeamManageAPIView requires only IsAuthenticated and omits the global support-role authorization check intended for this help-desk surface. Any authenticated learner can supply an email, username, or user_id for an arbitrary target and use the 200 and 404 response discrepancy to distinguish an active account from an absent or inactive account. A caller with a course-level or organization-level instructor role can additionally obtain the target user's staff or instructor assignments within the caller's course or organization scope. Anonymous callers remain blocked, and the separately authorized PUT behavior is outside this vulnerability. This issue is fixed in release/ulmo.4 and release/verawood.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-11-04

Last Modified

2026-11-04

Generated

2026-11-05

AI Q&A

2026-11-05

EPSS Evaluated

N/A

NVD

CVE-2026-97702

Affected Vendors & Products

Vendor	Product	Version / Range
openedx	openedx-platform	>= release/ulmo, < release/ulmo.4
openedx	openedx-platform	>= release/verawood, < release/verawood.1

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
CWE-204	The product provides different responses to incoming requests in a way that reveals internal state information to an unauthorized actor outside of the intended control sphere.

Attack-Flow Graph

Executive Summary

This vulnerability in Open edX Platform allows authenticated users to check if an account exists by exploiting a 200 or 404 response discrepancy. Users with instructor roles can also view staff or instructor assignments for other users within their course or organization scope.

Detection Guidance

Detect this vulnerability by checking Open edX Platform versions before release/ulmo.4 and release/verawood.1. Verify if the GET /api/support/v1/manage_course_team/ endpoint lacks proper authorization checks. Test for account enumeration by sending requests with different user identifiers and observing 200 vs 404 responses.

Impact Analysis

An attacker could identify active user accounts and gather information about staff or instructor roles, potentially leading to privacy breaches or targeted attacks. The impact is limited to authenticated users and does not affect anonymous callers.

Compliance Impact

This vulnerability could violate data protection regulations like GDPR or HIPAA by exposing user account existence and role information without proper authorization, leading to potential compliance breaches.

Mitigation Strategies

Upgrade Open edX Platform to release/ulmo.4 or release/verawood.1 or later. Ensure the GET /api/support/v1/manage_course_team/ endpoint enforces global support-role authorization checks. Restrict access to sensitive endpoints and audit user roles and permissions.

Hi! I’m here to help you understand CVE-2026-97702. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...