CVE-2026-53635: CWE-862: Missing Authorization in openedx openedx-platform

The Open edX Platform had a missing authorization vulnerability (CWE-862) in the set_course_mode_price() view function located in lms/djangoapps/instructor/views/instructor_dashboard.py. Prior to commit 59bb6d6, this function was only decorated with @login_required and did not verify course-level permissions, allowing any authenticated user, including learners without course roles, to send a POST request to overwrite the honor mode price and currency of any course. The frontend modal for this functionality was removed earlier, but the backend endpoint remained accessible, making it an unguarded orphan endpoint. This vulnerability has been patched in commit 59bb6d6.

An attacker with any authenticated account on the platform could modify the pricing and currency settings of any course, potentially disrupting course monetization and causing financial or operational impact. The vulnerability does not allow privilege escalation beyond authenticated user level but compromises course pricing integrity. The CVSS score is 7.6 (high severity) reflecting low attack complexity, low privileges required, no user interaction, and impact on integrity and availability.

This vulnerability has been patched by commit 59bb6d6 which added proper course-level authorization checks to the set_course_mode_price() view. Users should update their Open edX Platform installations to include this fix. Since the vendor advisory or patch link is not explicitly provided, check the official Open edX repository or security advisories for commit 59bb6d6 to apply the patch.