CVE-2025-68270

CriticalCVSS 9.9/10Last modified Jun 17, 2026

Description

The Open edX Platform is a learning management platform. Prior to commit 05d0d0936daf82c476617257aa6c35f0cd4ca060, CourseLimitedStaffRole users are able to access and edit courses in studio if they are granted the role on an org rather than on a course, and CourseLimitedStaffRole users are able to list courses they have the role on in studio even though they are not meant to have any access on the studio side for the course. Commit 05d0d0936daf82c476617257aa6c35f0cd4ca060 fixes the issue.

Metrics

CVSS 3.1 9.9/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L

Weakness enumeration

CWE-862

Affected software

No affected versions have been published.

Timeline

Published: Dec 16, 2025
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-6827110.0OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. From 5.0.0 to 6.10.1 CVE-2025-682727.5Signal K Server is a server application that runs on a central hub in a boat. A Denial of Service (DoS) vulnerability in versions prior to 2 CVE-2025-682735.3Signal K Server is a server application that runs on a central hub in a boat. An unauthenticated information disclosure vulnerability in ver CVE-2025-682747.5SIPGO is a library for writing SIP services in the GO language. Starting in version 0.3.0 and prior to version 1.0.0-alpha-1, a nil pointer CVE-2025-682754.8ChurchCRM is an open-source church management system. Versions prior to 6.5.3 have a stored cross-site scripting vulnerability on the pages CVE-2025-682765.5Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. In 0.9-rc2 and earlier, an unpr CVE-2025-682775.0OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 7.0.4, when a link CVE-2025-682788.8Tina is a headless content management system. In tinacms prior to version 3.1.1, tinacms uses the gray-matter package in an insecure way all CVE-2025-682796.5Weblate is a web based localization tool. In versions prior to 5.15.1, it was possible to read arbitrary files from the server file system u CVE-2025-68289.8A vulnerability has been found in code-projects Inventory Management System 1.0 and classified as critical. This vulnerability affects unkno CVE-2025-682806.5Improper Restriction of XML External Entity Reference vulnerability in Apache SIS. It is possible to write XML files in such a way that, CVE-2025-68281In the Linux kernel, the following vulnerability has been resolved: ASoC: SDCA: bug fix while parsing mipi-sdca-control-cn-list "struct sd