CVE-2026-24666: Open eClass is Vulnerable to CSRF in Teacher-Restricted Endpoints Allows Unauthorized Actions
The Open eClass platform (formerly known as GUnet eClass) is a complete course management system. Prior to version 4.2, a Cross-Site Request Forgery (CSRF) vulnerability in multiple teacher-restricted endpoints allows attackers to induce authenticated teachers to perform unintended actions, such as modifying assignment grades, via crafted requests. This issue has been patched in version 4.2.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-24666?
CVE-2026-24666 is classified as a high-severity vulnerability due to its potential for enabling unauthorized actions through CSRF attacks.
How do I fix CVE-2026-24666?
To fix CVE-2026-24666, upgrade your Open eClass installation to version 4.2 or later, which addresses the CSRF vulnerability.
What type of vulnerability is CVE-2026-24666?
CVE-2026-24666 is a Cross-Site Request Forgery (CSRF) vulnerability that affects teacher-restricted endpoints in Open eClass.
Who is affected by CVE-2026-24666?
CVE-2026-24666 affects users of Open eClass versions prior to 4.2, particularly those utilizing teacher-restricted functionalities.
What actions can be exploited due to CVE-2026-24666?
CVE-2026-24666 allows attackers to perform unauthorized actions in teacher-restricted endpoints without proper authentication.