CVE-2026-24666

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-24666", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-01-23T20:40:23.387Z", "datePublished": "2026-02-03T16:58:57.928Z", "dateUpdated": "2026-02-04T16:51:54.343Z"}, "containers": {"cna": {"title": "Open eClass is Vulnerable to CSRF in Teacher-Restricted Endpoints Allows Unauthorized Actions", "problemTypes": [{"descriptions": [{"cweId": "CWE-352", "lang": "en", "description": "CWE-352: Cross-Site Request Forgery (CSRF)", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/gunet/openeclass/security/advisories/GHSA-cgmh-73qg-28fm", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/gunet/openeclass/security/advisories/GHSA-cgmh-73qg-28fm"}], "affected": [{"vendor": "gunet", "product": "openeclass", "versions": [{"version": "< 4.2", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-03T16:58:57.928Z"}, "descriptions": [{"lang": "en", "value": "The Open eClass platform (formerly known as GUnet eClass) is a complete course management system. Prior to version 4.2, a Cross-Site Request Forgery (CSRF) vulnerability in multiple teacher-restricted endpoints allows attackers to induce authenticated teachers to perform unintended actions, such as modifying assignment grades, via crafted requests. This issue has been patched in version 4.2."}], "source": {"advisory": "GHSA-cgmh-73qg-28fm", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-04T15:46:30.288501Z", "id": "CVE-2026-24666", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-04T16:51:54.343Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-24666", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-04T15:46:30.288501Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-04T15:46:31.288Z"}}], "cna": {"title": "Open eClass is Vulnerable to CSRF in Teacher-Restricted Endpoints Allows Unauthorized Actions", "source": {"advisory": "GHSA-cgmh-73qg-28fm", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "gunet", "product": "openeclass", "versions": [{"status": "affected", "version": "< 4.2"}]}], "references": [{"url": "https://github.com/gunet/openeclass/security/advisories/GHSA-cgmh-73qg-28fm", "name": "https://github.com/gunet/openeclass/security/advisories/GHSA-cgmh-73qg-28fm", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "The Open eClass platform (formerly known as GUnet eClass) is a complete course management system. Prior to version 4.2, a Cross-Site Request Forgery (CSRF) vulnerability in multiple teacher-restricted endpoints allows attackers to induce authenticated teachers to perform unintended actions, such as modifying assignment grades, via crafted requests. This issue has been patched in version 4.2."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-352", "description": "CWE-352: Cross-Site Request Forgery (CSRF)"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-03T16:58:57.928Z"}}}, "cveMetadata": {"cveId": "CVE-2026-24666", "state": "PUBLISHED", "dateUpdated": "2026-02-04T16:51:54.343Z", "dateReserved": "2026-01-23T20:40:23.387Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-02-03T16:58:57.928Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "openeclass", "vendor": "gunet", "versions": [{"status": "affected", "version": "< 4.2"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:gunet:open_eclass_platform:*:*:*:*:*:*:*:*", "matchCriteriaId": "62F1C084-2C90-4AB3-A13E-28323DC385C0", "versionEndExcluding": "4.2", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Open eClass platform (formerly known as GUnet eClass) is a complete course management system. Prior to version 4.2, a Cross-Site Request Forgery (CSRF) vulnerability in multiple teacher-restricted endpoints allows attackers to induce authenticated teachers to perform unintended actions, such as modifying assignment grades, via crafted requests. This issue has been patched in version 4.2."}, {"lang": "es", "value": "La plataforma Open eClass (anteriormente conocida como GUnet eClass) es un sistema completo de gesti\u00f3n de cursos. Antes de la versi\u00f3n 4.2, una vulnerabilidad de falsificaci\u00f3n de petici\u00f3n en sitios cruzados (CSRF) en m\u00faltiples puntos finales restringidos para profesores permite a los atacantes inducir a profesores autenticados a realizar acciones no intencionadas, como modificar las calificaciones de las tareas, a trav\u00e9s de peticiones manipuladas. Este problema ha sido parcheado en la versi\u00f3n 4.2."}], "id": "CVE-2026-24666", "lastModified": "2026-06-17T10:23:23.137", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-24666", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-02-04T15:46:30.288501Z", "version": "2.0.3"}}]}, "published": "2026-02-03T18:16:19.690", "references": [{"source": "security-advisories@github.com", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/gunet/openeclass/security/advisories/GHSA-cgmh-73qg-28fm"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-352"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-18T00:17:14.815381+00:00", "value": {"mitigation_remediation": ["Deploy the vendor\u2011supplied patch to version\u202f4.2 or later.", "Ensure that all teacher\u2011restricted endpoints require valid anti\u2011CSRF tokens and that session cookies use SameSite=Strict or Lax to impede cross\u2011origin requests.", "Audit current endpoints for missing CSRF protection and remediate any that still accept forged requests."], "summary": {"action": "Patch Now", "impact": "Cross\u2011Site Request Forgery (unauthorized teacher actions)"}, "threat_synthesis": {"affected_systems": "All Open eClass installations running a version earlier than 4.2 are vulnerable. This includes every deployment of the platform that has not yet incorporated the patch delivered in release 4.2.", "description_and_impact": "The Open eClass platform suffers from a CSRF flaw affecting several teacher\u2011restricted API endpoints. An attacker can craft a malicious request that, when viewed by an authenticated teacher, triggers unintended operations such as changing assignment grades. The vulnerability is rooted in CWE\u2011352, allowing session hijacking through forged requests.", "risk_and_exploitability": "The vulnerability carries a CVSS score of 6.5, indicating a moderate severity. The EPSS score is below 1\u202f%, showing a low probability of exploitation in the wild, and the issue is not listed in CISA\u2019s KEV catalog. Exploitation requires an attacker to get a teacher to load a crafted request, typically via phishing or a malicious web page, while their browser maintains an authenticated session. Given the lack of known active exploits and the low EPSS, the immediate risk is moderate but should be mitigated promptly to prevent potential credential\u2011reuse and data\u2011manipulation attacks."}}}}, "created": "2026-02-04T12:09:20.078133+00:00", "updated": "2026-04-18T00:30:25.701411+00:00", "vendors": ["openeclass", "openeclass$PRODUCT$openeclass"]}