CVE-2026-53635 in edX Platform
Summary
by MITRE • 09/02/2026
Open edX Platform enables the authoring and delivery of online learning at any scale. Prior to commit 59bb6d6, the view function set_course_mode_price() at lms/djangoapps/instructor/views/instructor_dashboard.py:430 is decorated only with @login_required and performs no course-level permission check. Any authenticated user — including a learner account with zero course roles — can issue a single POST request to overwrite the honor mode price and currency of any course on the platform. The companion frontend modal was removed in a prior cleanup, but the URL route and view remain live, making this an unguarded orphan endpoint. This issue has been patched via commit 59bb6d6.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/02/2026
The Open edX platform serves as a robust infrastructure for authoring and delivering online learning content at scale, relying heavily on role-based access control to maintain the integrity of course configurations. A critical security flaw was identified within the instructor dashboard functionality, specifically in the view function set_course_mode_price located in the file lms/djangoapps/instructor/views/instructor_dashboard.py at line 430. This vulnerability stems from an insufficient authorization check that allows any authenticated user to modify sensitive pricing settings for courses they do not own or have administrative privileges over. Prior to the patching commit, this endpoint was protected only by a generic login requirement decorator, which verifies that a user is logged in but fails to validate whether that specific user has the necessary permissions to alter course-level data.
The technical nature of this flaw constitutes an insecure direct object reference combined with broken access control. Because the view function lacks explicit checks for instructor or staff roles relative to the target course ID provided in the request, it treats all authenticated sessions equally regarding write operations on course modes. An attacker possessing a standard learner account can exploit this by crafting a single POST request to the associated URL route. This action allows them to overwrite the honor mode price and currency settings of any arbitrary course hosted on the platform. The persistence of this vulnerability is exacerbated by the fact that while the companion frontend modal was removed in a prior cleanup, the backend API endpoint remained active and unguarded, creating an orphaned entry point for exploitation.
The operational impact of this vulnerability is significant as it undermines the financial integrity and configuration consistency of educational offerings on the platform. By allowing unauthorized modification of course mode prices, malicious actors could potentially disrupt revenue models, create confusion among students regarding costs, or use the platform to host courses with misleading pricing structures. This type of attack can also serve as a vector for further exploitation if these modified settings trigger downstream processes that assume valid administrative input. The ability to alter currency and price data without proper authorization represents a severe breach of trust in the system's permission model, potentially leading to financial loss or reputational damage for course providers who rely on accurate pricing configurations.
This vulnerability aligns with Common Weakness Enumeration CWE-862, which describes missing authorization checks that allow users to perform actions they are not permitted to do. It also relates closely to CWE-209, regarding the generation of error messages containing sensitive information if such errors were exposed during exploitation attempts, though the primary issue is the lack of access control. In terms of the MITRE ATT&CK framework, this behavior corresponds to T1531, Accessing Cloud Infrastructure Accounts or Services, specifically in the context of abusing legitimate user accounts to modify cloud-hosted application configurations without proper privileges. The attack vector leverages valid credentials but exploits a failure in server-side logic to escalate capabilities beyond those granted by the assigned role.
To mitigate this risk and prevent similar issues in future development cycles, it is essential to implement strict authorization checks at every endpoint that modifies critical configuration data. Developers should utilize Open edX's built-in permission decorators such as @require_course_staff or custom mixins that verify the user holds an instructor, staff, or admin role for the specific course ID referenced in the request parameters. Additionally, implementing automated security testing within the continuous integration pipeline can help detect missing authorization logic before code reaches production. The issue has been addressed through commit 59bb6d6, which introduces the necessary permission validations to ensure that only authorized personnel can modify course mode pricing and currency settings. Organizations running Open edX should verify they are operating on a version that includes this patch or manually apply the corresponding security fix to restore proper access controls.