CVE-2025-68270 - CVE House

Back to Database

Status published Critical CVE-2025-68270

CourseLimitedStaff Role Allows Studio Access

9.9 CVSS

Vulnerability Description

The Open edX Platform is a learning management platform. Prior to commit 05d0d0936daf82c476617257aa6c35f0cd4ca060, CourseLimitedStaffRole users are able to access and edit courses in studio if they are granted the role on an org rather than on a course, and CourseLimitedStaffRole users are able to list courses they have the role on in studio even though they are not meant to have any access on the studio side for the course. Commit 05d0d0936daf82c476617257aa6c35f0cd4ca060 fixes the issue.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-68270

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

More from openedx

View All →

Learners on edX Platform can download python_lib.zip

openedx-translations's Atlas translations for Open edX missing validation

Open edX Platform's instructor upload CSV for cohort creation not Private by Default

XBlock custom auth does not respect JWT Scopes

xblock-lti-consumer contain Missing Authorization in Grade Pass Back Implementation

Affected Vendor

openedx

View all reports →

Affected Software

edx-platform

Vulnerable Versions:

< 05d0d0936daf82c476617257aa6c35f0cd4ca060

Timeline

Official Publish: December 16th, 2025

Last Modified: December 16th, 2025

Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L

Weaknesses (CWE)

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application

T1068 Exploitation for Privilege Escalation

Privilege Escalation

T1078 Valid Accounts

T1531 Account Access Removal