PT-2025-51780 · Open Edx · Open Edx

Published 2025-12-16 · Updated 2025-12-17 · CVE-2025-68270

Positive Technologies (AI Summary)

CVSS v3.1

9.9

Critical

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L

Name of the Vulnerable Software and Affected Versions Open edX versions prior to commit 05d0d0936daf82c476617257aa6c35f0cd4ca060

Description The Open edX Platform contains an issue where CourseLimitedStaffRole users with permissions granted at the organization level, rather than the course level, can access and modify courses in the studio environment. These users are also able to list courses they have the role on in studio, despite not being intended to have access. This allows unauthorized access and potential modification of course content.

Recommendations Update the Open edX Platform to commit 05d0d0936daf82c476617257aa6c35f0cd4ca060 or a later version to resolve the issue.

Exploit

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2025-68270

GHSA-RH64-VC2H-7WFJ

Affected Products

Open Edx

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/68xxx/CVE-2025-68270.json · Exploit
• https://osv.dev/vulnerability/CVE-2025-68270 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-68270 · Security Note
• https://github.com/openedx/edx-platform/pull/37772 · Note
• https://github.com/openedx/edx-platform/commit/05d0d0936daf82c476617257aa6c35f0cd4ca060 · Note
• https://github.com/openedx/edx-platform/pull/37773 · Note
• https://github.com/openedx/edx-platform/security/advisories/GHSA-rh64-vc2h-7wfj · Note
• https://t.me/CVEtracker/40002 · Telegram Post
• https://twitter.com/CVEnew/status/2001350867992383517 · Twitter Post
• https://twitter.com/offseq/status/2001080718256935020 · Twitter Post