Open eClass <=4.1 Broken Access Control: Authenticated Student Privilege Escalation (CVE-2026-24670)

Key Information Summary Vulnerability Basic Information Vulnerability ID: GHSA-4jf5-636r-hv9v Vulnerability Type: Broken Access Control CVSS 3.1 Score: 6.5 CVE ID: CVE-2026-24670 CWE ID: CWE-284 Affected Scope Affected Application: Open eClass Affected Versions: <= 4.1 Fixed Version: 4.2 Vulnerability Description Summary: A failed access control vulnerability allows authenticated students to create new course units, an action typically restricted to higher-privilege roles. Detailed Information: - The application fails to enforce proper access control on the endpoint. Authenticated users with the "student" role can access functionalities intended only for teachers or administrators and create new course units. - This improper authorization enables users to manipulate course structure in unintended ways, violating role-based access policies and potentially compromising course integrity. Vulnerability Details and Verification Method Affected Endpoint: POST Proof of Concept (PoC): 1. Authenticate using a user account with the "student" role. 2. Submit a request to the affected endpoint with valid parameters (e.g., unit title, description). 3. Observe the newly created unit, despite the user lacking teacher privileges. Screenshots and Logs: Show the operation process, interface changes, and server responses, confirming that a student user successfully created a course unit and received unauthorized feedback. Vulnerability Discoverer Discoverer and Reporter: Alexandros Perrakis (GitHub username: Stolichnayer)

Goal Reached Thanks to every supporter — we hit 100%!

Open eClass <=4.1 Broken Access Control: Authenticated Student Privilege Escalation (CVE-2026-24670)

More from this source