PT-2026-6198 · Unknown · Open Eclass

Stolichnayer · CVE-2026-24666 · Published 2026-02-03 · Updated 2026-02-10

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Open eClass versions prior to 4.2

Description The Open eClass platform, previously known as GUnet eClass, is a course management system. A Cross-Site Request Forgery (CSRF) issue exists in teacher-restricted endpoints prior to version 4.2. This allows attackers to trick authenticated teachers into performing unwanted actions, such as altering assignment grades, through specially designed requests. The affected endpoints allow unauthorized actions.

Recommendations Update to version 4.2 or later.

Exploit

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2026-24666

GHSA-CGMH-73QG-28FM

Affected Products

Open Eclass

References · 6

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/24xxx/CVE-2026-24666.json · Exploit
• https://github.com/gunet/openeclass/security/advisories/GHSA-cgmh-73qg-28fm · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-24666 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-24666 · Security Note
• https://t.me/CVEtracker/43631 · Telegram Post
• https://t.me/cveNotify/151611 · Telegram Post