# CVE-2026-97702: Open edX Platform authorization bypass in course team API

Source: https://junglewise.ai/threats/cve-2026-97702-open-edx-platform-enables-the-authoring-and-delivery-of-online  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-04. Updated: 2026-11-04  
License: CC BY 4.0 with a link back

CVE-2026-97702 · Severity: medium · CVSS 5.3 · Published 2026-11-04

Open edX is a platform for creating and delivering online courses at scale. An authenticated learner can query the course team management API endpoint to enumerate which user accounts exist in the system and learn which courses other users teach or assist with—information that should only be visible to administrators and support staff. This leaks information about course structure and staff assignments.

Technologies: [Open edX Platform](https://junglewise.ai/threats/technologies/open-edx-platform). Vendors: [Open edX](https://junglewise.ai/threats/vendors/open-edx).

## Quick answers

**Is CVE-2026-97702 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-97702 being exploited in the wild.

**How severe is CVE-2026-97702?** Medium severity, with a CVSS score of 5.3, published 4 November 2026.

**Which products and versions are affected?** Open edX Platform Ulmo release through release/ulmo.3 and release/verawood.0.

**Is there a fix for CVE-2026-97702?** Yes: fixed in release/ulmo.4, release/verawood.1. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-97702 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-97702?** Check whether you run Open edX Platform at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in release/ulmo.4, release/verawood.1

## Technical details

The GET /api/support/v1/manage_course_team/ endpoint in CourseTeamManageAPIView applied only IsAuthenticated permission check, missing the role-based authorization required for the support surface. Authenticated users could exploit a 200 vs. 404 response discrepancy (CWE-204) to enumerate active user accounts by email, username, or user_id, and users with instructor roles could additionally view target users' staff/instructor role assignments within their course or organization scope. The fix gates the GET method on proper authorization checks matching the PUT operation's security requirements.

## Affected products

- Open edX Open edX Platform Ulmo release through release/ulmo.3 and release/verawood.0

## Timeline

- 2026-11-04: disclosed

## References

- [https://github.com/openedx/openedx-platform/commit/46c543590c78aa1bfa846d47a4f1c5c6ec388490](https://github.com/openedx/openedx-platform/commit/46c543590c78aa1bfa846d47a4f1c5c6ec388490)
- [https://github.com/openedx/openedx-platform/commit/e2a1215f8d5da5170ddbf10316c2362e965e17bc](https://github.com/openedx/openedx-platform/commit/e2a1215f8d5da5170ddbf10316c2362e965e17bc)

## Related threats

- [Open edX Platform path traversal in archive extraction](https://junglewise.ai/threats/cve-2026-85272-open-edx-platform-enables-the-authoring-and-delivery-of-online)
- [Open edX Platform SSRF in video download endpoint](https://junglewise.ai/threats/cve-2026-55421-open-edx-platform-ssrf-in-video-download-endpoint)
- [Open edX Platform LTI replay attack in nonce validation](https://junglewise.ai/threats/cve-2026-53636-open-edx-platform-lti-replay-attack-in-nonce-validation)
- [Open edX Platform privilege escalation in course price setting](https://junglewise.ai/threats/cve-2026-53635-open-edx-platform-privilege-escalation-in-course-price-setting)
- [Open edX Platform open redirect in survey views](https://junglewise.ai/threats/cve-2026-35404-open-edx-platform-open-redirect-in-survey-views)