CVE-2026-53635: Open edX Platform: Insufficient Permission on set_course_mode_price()
Open edX Platform enables the authoring and delivery of online learning at any scale. Prior to commit 59bb6d6, the view function setcoursemodeprice() at lms/djangoapps/instructor/views/instructordashboard.py:430 is decorated only with @loginrequired and performs no course-level permission check. Any authenticated user — including a learner account with zero course roles — can issue a single POST request to overwrite the honor mode price and currency of any course on the platform. The companion frontend modal was removed in a prior cleanup, but the URL route and view remain live, making this an unguarded orphan endpoint. This issue has been patched via commit 59bb6d6.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch 59bb6d6
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated Open edX user can exploit it, including a learner account with no roles in the targeted course. The attacker does not need instructor or course-staff permissions.
What access and interaction does exploitation require?
Exploitation requires a logged-in account and a single POST request to the still-live endpoint. No user interaction is required.
Are platforms affected even though the related frontend modal was removed?
Yes. Removing the frontend modal did not remove the URL route or its backend view, leaving the endpoint reachable as an orphaned route.
How can I determine whether my deployment is affected?
Check whether the deployment includes commit 59bb6d6. Versions prior to that commit have the view protected only by login authentication and lack a course-level permission check.
What is the remediation?
Apply the patch in commit 59bb6d6. The provided data does not specify an alternative mitigation for deployments that cannot immediately apply the patch.