Description

Open edX Platform enables the authoring and delivery of online learning at any scale. Prior to commit 59bb6d6, the view function set_course_mode_price() at lms/djangoapps/instructor/views/instructor_dashboard.py:430 is decorated only with @login_required and performs no course-level permission check. Any authenticated user — including a learner account with zero course roles — can issue a single POST request to overwrite the honor mode price and currency of any course on the platform. The companion frontend modal was removed in a prior cleanup, but the URL route and view remain live, making this an unguarded orphan endpoint. This issue has been patched via commit 59bb6d6.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.6",
  "pubDate": "2026-09-02T17:17:45.770Z",
  "pubdate": "2026-09-02T17:17:45.770Z",
  "executiveSummary": "This vulnerability is an Improper Authorization flaw identified in the Open edX Platform.\nThe issue resides within the set_course_mode_price() function, which lacks requisite course-level access controls.\nAny authenticated user on the platform can exploit this vulnerability to perform unauthorized modifications to course financial parameters, specifically the honor mode price and currency settings.\nThe risk is significant as it allows low-privileged learners to manipulate course metadata globally without administrative permissions.\nThe vulnerability exists due to an orphaned API endpoint that remained active despite the removal of its frontend interface, failing to enforce mandatory permission checks.\nSuccessful exploitation requires only a standard authenticated user account and the ability to craft a POST request to the vulnerable endpoint.\nThis represents a significant integrity risk to the platform's course configuration data and business logic.",
  "technicalDetails": "The vulnerability originates in the lms/djangoapps/instructor/views/instructor_dashboard.py file at the set_course_mode_price() function.\nThe root cause is an Authorization Bypass; the function is decorated exclusively with @login_required, which validates the user's authentication status but fails to verify if the user possesses the necessary administrative or instructor privileges for the targeted course.\nBecause the platform exposes this URL route despite the removal of the associated frontend UI components, the function acts as an unguarded orphan endpoint.\nThe exploitation flow involves the following steps: First, an attacker logs into the platform with a standard learner account. Second, the attacker constructs a malicious POST request targeting the endpoint managed by set_course_mode_price(). Third, the request includes parameters defining the desired price and currency for a specific course ID. Finally, the backend processes the request and overwrites the course configuration in the database.\nSince the view function does not validate the relationship between the authenticated user and the specific course being modified, any authenticated user can successfully execute a change to the honor mode price and currency of any course on the system.\nThis flaw is present in all versions of the Open edX Platform prior to commit 59bb6d6.\nThe impact of a successful attack includes the manipulation of financial course data, which can lead to economic inconsistencies, revenue loss, or administrative disruption depending on the platform's monetization model.\nThe vulnerability is reachable over the network via standard HTTP/HTTPS protocols, and the lack of object-level authorization ensures that no complex bypassing techniques are required beyond issuing a direct request to the undocumented or orphaned route.\nThe absence of a check such as a permission-required decorator or a custom access control function at the view level allows the bypass to persist across all instances of the application that have not yet applied the patch found in commit 59bb6d6."
}