CVE-2026-53635

CVE-2026-53635 is a missing-authorization flaw (CWE-862) in Open edX Platform's instructor dashboard, where the set_course_mode_price() view in lms/djangoapps/instructor/views/instructor_dashboard.py is protected only by @login_required and performs no course-level permission check. Because the companion frontend modal was removed in an earlier cleanup but the URL route and view remain live, any authenticated user — including a learner account with zero course roles — can trigger the flaw with a single POST request to the orphan endpoint. An attacker gains the ability to overwrite the honor mode price and currency of any course on the platform, corrupting course commerce configuration without needing elevated privileges. All Open edX Platform deployments running code prior to commit 59bb6d6 are affected; the issue is fixed in commit 59bb6d6. No public proof-of-concept or in-the-wild exploitation is known, and EPSS estimates only about a 0.2% probability of exploitation within 30 days.

What to do: Update Open edX Platform to a release containing commit 59bb6d6, or cherry-pick that commit into your deployment. As an interim mitigation, restrict or disable access to the set_course_mode_price URL route for non-staff users. Operators should also review recent changes to course honor mode pricing and currency to detect any unauthorized modifications.