CVE-2026-97702

Name of the Vulnerable Software and Affected Versions Open edX Platform versions Ulmo through release/ulmo.4 Open edX Platform versions Ulmo through release/verawood.1

Description The GET '/api/support/v1/manage course team/' endpoint in CourseTeamManageAPIView lacks a global support-role authorization check, requiring only that a user be authenticated. This allows any authenticated learner to provide an email, username, or user id to determine if an account is active based on the difference between 200 and 404 responses. Furthermore, users with course-level or organization-level instructor roles can retrieve the staff or instructor assignments of a target user within their specific scope.

Recommendations Update to release/ulmo.4. Update to release/verawood.1.