Openedx vulnerabilities
We track 6 vulnerabilities in Openedx products across 5 products. 6 are rated high or critical, and none are known to be exploited. The most recent was published on September 2, 2026.
Latest Openedx vulnerabilities
- 7.6 High severity
openedx-platform: Missing Authorization
Open edX Platform enables the authoring and delivery of online learning at any scale. Prior to commit 59bb6d6, the view function set_course_mode_price() at lms/djangoapps/instructor/views/instructor_dashboard.py:430 is decorated only with @login_required and p
- 8.5 High severity
edx-enterprise: Server-Side Request Forgery
The Open edx Enterprise Service app provides enterprise features to the Open edX platform. From 7.0.2 to 7.0.4, the sync_provider_data endpoint in SAMLProviderDataViewSet fetches SAML metadata from a URL stored in SAMLProviderConfig.metadata_source. An authent
- 9.9 Critical severity
openedx-platform: Server-Side Request Forgery
Open edX Platform enables the authoring and delivery of online learning at any scale. The sync_provider_data endpoint in SAMLProviderDataViewSet allows authenticated Enterprise Admin users to supply an arbitrary URL via the metadata_url POST parameter. This UR
- 9.9 Critical severity
edx-platform: Missing Authorization
The Open edX Platform is a learning management platform. Prior to commit 05d0d0936daf82c476617257aa6c35f0cd4ca060, CourseLimitedStaffRole users are able to access and edit courses in studio if they are granted the role on an org rather than on a course, and Co
- 9.8 Critical severity
openedx-translations: Improper Neutralization of Special Elements in Output Used by a Downstream Component
This openedx-translations repository contains translation files from Open edX repositories to be kept in sync with Transifex. Before moving to pulling translations from the openedx-translations repository via openedx-atlas, translations in the edx-platform rep
- 8.8 High severity
edx-platform: Improper Access Control
Open edX Platform is a service-oriented platform for authoring and delivering online learning. A user with a JWT and more limited scopes could call endpoints exceeding their access. This vulnerability has been patched in commit 019888f.