CVE-2026-53635

Name of the Vulnerable Software and Affected Versions Open edX Platform versions prior to commit 59bb6d6

Description An authenticated user, including those with learner accounts and no course roles, can overwrite the honor mode price and currency of any course on the platform. This occurs because the view function set course mode price() is decorated only with @login required and lacks a course-level permission check. Although the associated frontend modal was removed, the URL route and view remain active as an unguarded orphan endpoint, allowing the modification of course pricing via a single POST request.

Recommendations Update Open edX Platform to commit 59bb6d6 or a newer version.