Opencast Editor CVE-2025-61906

Exploitation requires an authenticated user holding write access to a specific event (PR:L), who then uses the Opencast editor and performs a precise action sequence: clicking 'Save & Publish' and subsequently selecting the 'Save' option, which causes the previously selected publish workflow to execute without notification (matching AT:P, attack requirements present). Limiting factors are significant: the actor must already have write permissions, must deliberately use the editor (normally only done when intending to publish), and must follow the specific Save & Publish → Save order. There is no cross-user attack vector and no unauthenticated path; the condition is effectively a self-inflicted accidental publish rather than adversarial exploitation.

This is a genuinely low-priority issue, and the multiple signals agree rather than conflict. The vendor-assigned CVSS 4.0 score is only 2.3 (Low), with attack requirements present (AT:P), low privileges required (PR:L), and only low confidentiality impact (VC:L) with no integrity or availability impact. EPSS reinforces this at 0.29% (21st percentile), indicating very low predicted exploitation likelihood. The vulnerability is NOT listed in CISA KEV, so there is no public evidence of active exploitation. A POC/reference does exist (the GitHub issue #1626 describing the behavior), but POC availability must not be conflated with active exploitation - here it is essentially a bug report documenting the unexpected publish behavior, not a weaponized exploit. Critically, the 'attacker' and 'victim' are effectively the same actor: this is a UI safety flaw where a user with write access can accidentally publish media when intending only to save. There is no cross-user privilege escalation or remote takeover. The vendor itself states the real-world impact risk is very low. Bottom line: a low-CVSS, low-EPSS, non-KEV issue that is a usability/data-exposure safety defect rather than a security priority.

An authenticated user with write access to an event opens the Opencast editor intending to save draft changes to internal, unpublished media. They click 'Save & Publish' and then select the 'Save' option; due to the editor passing the selected workflow regardless of intent, the media is published without any notification, exposing content not meant for release. A public reference (GitHub issue #1626) documents this behavior, but no weaponized exploit against other users exists.