What is the CVSS score of CVE-2026-53635?

CVE-2026-53635 has a CVSS 3.1 base score of 7.6 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L. EPSS exploitation probability: 0.2%.

Which versions of Open edX Platform are affected by CVE-2026-53635?

Open edX Platform deployments allow any authenticated learner account to arbitrarily modify honor-mode course prices and currencies across all courses without authorization checks.. A patch is available.

How to fix or mitigate CVE-2026-53635?

Within 24 hours: Verify your Open edX version and audit the lms/djangoapps/instructor/views/instructor_dashboard.py file to confirm the vulnerable set_course_mode_price() endpoint is present; implement Web Application Firewall rules to require additional authentication factors for any requests to this endpoint, and immediately review course pricing change logs for anomalies. Within 7 days: Deploy application-level compensating controls by modifying the endpoint to enforce course-level role verification (instructor or staff only) before accepting price changes, and establish automated alerting on unauthorized price modification attempts. Within 30 days: Monitor the Open edX project for patched versions as they become available and plan upgrade testing in a non-production environment; conduct a complete financial audit of all course pricing to restore legitimate values and quantify revenue impact.

Open edX Platform CVE-2026-53635

EUVD-2026-70221 HIGH

Missing Authorization (CWE-862)

2026-09-02 GitHub_M

Openedx Platform Openedx

7.6

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

7.6 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L

vuln.today AI

7.6 HIGH

Network-reachable with any low-privilege account (PR:L, AV:N, AC:L); high integrity impact on pricing data, minimal confidentiality/availability side effects.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

High

Availability

Low

Lifecycle Timeline

POC Analysis Generated

Sep 08, 2026 - 15:31 vuln.today

Patch available

Sep 02, 2026 - 18:17 EUVD

Metadata Corrected

Sep 02, 2026 - 17:40 vuln.today

tag: Authentication Bypass removed

Source Code Evidence Fetched

Sep 02, 2026 - 17:23 vuln.today

Analysis Generated

Sep 02, 2026 - 17:23 vuln.today

CVE Published

Sep 02, 2026 - 16:53 cve.org

HIGH 7.6

DescriptionCVE.org

Open edX Platform enables the authoring and delivery of online learning at any scale. Prior to commit 59bb6d6, the view function set_course_mode_price() at lms/djangoapps/instructor/views/instructor_dashboard.py:430 is decorated only with @login_required and performs no course-level permission check. Any authenticated user - including a learner account with zero course roles - can issue a single POST request to overwrite the honor mode price and currency of any course on the platform. The companion frontend modal was removed in a prior cleanup, but the URL route and view remain live, making this an unguarded orphan endpoint. This issue has been patched via commit 59bb6d6.

AnalysisAI

Missing authorization on the set_course_mode_price() instructor endpoint in Open edX Platform allows any authenticated user - including learner accounts with zero course roles - to overwrite the honor-mode price and currency for any course on the platform. The view at lms/djangoapps/instructor/views/instructor_dashboard.py:430 enforces only @login_required with no course-level role check, and became an orphaned API route after its companion frontend modal was removed. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Persist

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Persist

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	Exploitation requires a valid authenticated session on the Open edX instance - any registered account qualifies, including learners with no course roles or instructor assignments. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 7.6 vector AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L accurately captures the risk profile: network-reachable with no complexity, requiring only a valid low-privilege account, and delivering high integrity impact on course pricing data. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	The upstream fix is available via commit 59bb6d669e4fdc24d96afb809e12119372d9e257, which adds a staff-only authorization guard to `set_course_mode_price()`. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours: Verify your Open edX version and audit the lms/djangoapps/instructor/views/instructor_dashboard.py file to confirm the vulnerable set_course_mode_price() endpoint is present; implement Web Application Firewall rules to require additional authentication factors for any requests to this endpoint, and immediately review course pricing change logs for anomalies. …

Threat intelligence, references, and detailed analysis are available after sign-in.