CVE-2026-53635
Received Received - Intake

Unauthorized Price Modification in Open edX Platform

Publication date: 2026-09-02

Last updated on: 2026-09-02

Assigner: GitHub, Inc.

Description
Open edX Platform enables the authoring and delivery of online learning at any scale. Prior to commit 59bb6d6, the view function set_course_mode_price() at lms/djangoapps/instructor/views/instructor_dashboard.py:430 is decorated only with @login_required and performs no course-level permission check. Any authenticated user — including a learner account with zero course roles — can issue a single POST request to overwrite the honor mode price and currency of any course on the platform. The companion frontend modal was removed in a prior cleanup, but the URL route and view remain live, making this an unguarded orphan endpoint. This issue has been patched via commit 59bb6d6.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-02
Last Modified
2026-09-02
Generated
2026-09-02
AI Q&A
2026-09-02
EPSS Evaluated
N/A
NVD
CVE-2026-53635
EUVD
EUVD-2026-70221

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
edx open_edx to 59bb6d6 (exc)
openedx open_edx_platform *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Open edX platform allows any authenticated user, including learners with no special course roles, to modify the honor mode price and currency of any course by sending a single POST request. The issue occurs because the set_course_mode_price() function only requires login but lacks proper authorization checks to verify if the user has permission to modify the course. This enables privilege escalation where unauthorized users can change course pricing and currency settings.

The vulnerability exists due to missing course-level permission validation. Attackers can exploit this by knowing a course ID (which follows a public pattern) and sending manipulated POST requests to set prices to zero or arbitrary values like 'BTC'. The function processes these requests without validation, updating course settings and creating misleading audit trail entries.

Detection Guidance

To detect this vulnerability, check for unauthorized POST requests to the set_course_mode_price endpoint in Open edX logs. Look for requests from non-staff users modifying course prices or currencies. The endpoint is located at lms/djangoapps/instructor/views/instructor_dashboard.py. Monitor for 403 errors after applying the fix, indicating proper authorization checks are in place.

Impact Analysis

If you are an Open edX platform user, this vulnerability could allow attackers to change course prices and currencies without authorization. For course administrators, this means potential revenue loss, disrupted ecommerce integrations, and corrupted audit trails. Learners might see incorrect pricing or currency displays. The impact extends to all courses since any authenticated user can modify any course's honor mode settings.

The vulnerability enables currency injection attacks and can inflate database records. Attackers could enumerate honor-mode configurations or create misleading change histories that obscure legitimate modifications. The integrity of the entire course catalog is at risk since a single compromised account could affect all courses.

Mitigation Strategies

Apply the patch from commit 59bb6d6 to restrict the set_course_mode_price endpoint to Django staff users only. Alternatively, remove the endpoint entirely if it is unused. Ensure input validation for price and currency fields to prevent secondary issues. Monitor logs for suspicious activity targeting this endpoint.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-53635. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart