Is CVE-2026-97702 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-97702 being exploited in the wild.

How severe is CVE-2026-97702?

Medium severity, with a CVSS score of 5.3, published 4 November 2026.

Which products and versions are affected?

Open edX Platform Ulmo release through release/ulmo.3 and release/verawood.0.

Is there a fix for CVE-2026-97702?

Yes: fixed in release/ulmo.4, release/verawood.1. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-97702 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-97702?

Check whether you run Open edX Platform at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-97702: Open edX Platform authorization bypass in course team API

CVE-2026-97702 · Severity: medium · CVSS 5.3 · Published 2026-11-04

Open edX is a platform for creating and delivering online courses at scale. An authenticated learner can query the course team management API endpoint to enumerate which user accounts exist in the system and learn which courses other users teach or assist with—information that should only be visible to administrators and support staff. This leaks information about course structure and staff assignments.

Technologies: Open edX Platform. Vendors: Open edX.

Quick answers

Is CVE-2026-97702 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-97702 being exploited in the wild.
How severe is CVE-2026-97702?: Medium severity, with a CVSS score of 5.3, published 4 November 2026.
Which products and versions are affected?: Open edX Platform Ulmo release through release/ulmo.3 and release/verawood.0.
Is there a fix for CVE-2026-97702?: Yes: fixed in release/ulmo.4, release/verawood.1. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-97702 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-97702?: Check whether you run Open edX Platform at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: release/ulmo.4, release/verawood.1

Technical details

The GET /api/support/v1/manage_course_team/ endpoint in CourseTeamManageAPIView applied only IsAuthenticated permission check, missing the role-based authorization required for the support surface. Authenticated users could exploit a 200 vs. 404 response discrepancy (CWE-204) to enumerate active user accounts by email, username, or user_id, and users with instructor roles could additionally view target users' staff/instructor role assignments within their course or organization scope. The fix gates the GET method on proper authorization checks matching the PUT operation's security requirements.

Affected products

Open edX Open edX Platform Ulmo release through release/ulmo.3 and release/verawood.0

Timeline

2026-11-04: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.