Threats affecting pkg:github/openedx/edx-platform

CVE-2025-68270 is a critical missing authorization vulnerability in the Open edX edx-platform that allows users with CourseLimitedStaffRole assigned at the organization level to access and edit courses in the studio interface improperly. This flaw permits unauthorized course listing and editing, violating intended access controls. The vulnerability affects versions prior to commit 05d0d0936daf82c476617257aa6c35f0cd4ca060, which contains the fix. Exploitation requires low privileges but no user interaction, and it can lead to full confidentiality and integrity compromise of course content with limited availability impact. No known exploits are reported in the wild yet. European educational institutions and organizations using Open edX are at risk, especially those with broad role assignments at the organizational level. Immediate patching and role assignment audits are recommended to mitigate this threat.