CVE-2026-24670
Broken Access Control in Open eClass Allows Unauthorized Course Creation
Publication date: 2026-02-03
Last updated on: 2026-02-10
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| gunet | open_eclass_platform | to 4.2 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-284 | The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-24670 is a broken access control vulnerability in the Open eClass platform affecting versions up to 4.1. It allows authenticated students, who normally have limited privileges, to create new course units, an action that should be restricted to instructors or administrators.
This happens because the platform fails to properly enforce access control on the POST /modules/units/index.php endpoint, letting students manipulate course structures and violate role-based access policies.
The vulnerability has been fixed in version 4.2.
How can this vulnerability impact me? :
This vulnerability can impact you by allowing unauthorized students to modify course content by creating new course units, which can compromise the integrity of courses.
Since the integrity of course structures can be altered without proper authorization, it may lead to confusion, misinformation, or disruption in course management.
The vulnerability has a moderate severity with a CVSS score of 6.5, indicating it is relatively easy to exploit remotely by any authenticated student without additional user interaction.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
[{'type': 'paragraph', 'content': 'This vulnerability can be detected by monitoring for unauthorized POST requests to the /modules/units/index.php endpoint from authenticated student accounts. Specifically, look for requests that attempt to create new course units, which should normally be restricted to instructors or administrators.'}, {'type': 'paragraph', 'content': 'A practical detection method involves capturing and analyzing HTTP traffic or server logs for POST requests with parameters such as unit title and description originating from student-level users.'}, {'type': 'paragraph', 'content': 'Example commands to detect such activity could include:'}, {'type': 'list_item', 'content': "Using grep on web server logs to find POST requests to the vulnerable endpoint: grep 'POST /modules/units/index.php' /var/log/apache2/access.log"}, {'type': 'list_item', 'content': 'Filtering logs for requests from student user accounts or IPs associated with students.'}, {'type': 'list_item', 'content': 'Using network traffic analysis tools like tcpdump or Wireshark to capture HTTP POST requests to the endpoint and inspecting their payloads.'}] [1]
What immediate steps should I take to mitigate this vulnerability?
The immediate and recommended step to mitigate this vulnerability is to upgrade the Open eClass platform to version 4.2 or later, where the broken access control issue has been patched.
Until the upgrade can be performed, consider restricting access to the /modules/units/index.php endpoint to only trusted roles (instructors or administrators) via web server configuration or application-level access controls.
Additionally, monitor and audit logs for any unauthorized attempts by student accounts to create course units and revoke or limit their privileges if suspicious activity is detected.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability allows authenticated students to perform unauthorized actions by creating new course units, violating role-based access control policies and compromising course integrity. This improper access control (CWE-284) could lead to integrity issues within the system.
However, there is no direct information provided about the impact of this vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.