CVE-2026-24666 — Open eClass is Vulnerable to CSRF in Teacher-Restricted Endpoints Allows Unauthorized Actions

CVE-2026-24666

Open eClass is Vulnerable to CSRF in Teacher-Restricted Endpoints Allows Unauthorized Actions PUBLISHED

Description (CNA)

The Open eClass platform (formerly known as GUnet eClass) is a complete course management system. Prior to version 4.2, a Cross-Site Request Forgery (CSRF) vulnerability in multiple teacher-restricted endpoints allows attackers to induce authenticated teachers to perform unintended actions, such as modifying assignment grades, via crafted requests. This issue has been patched in version 4.2.

Affected (CNA)

Vendor / product	Versions
gunet / openeclass	affected < 4.2

CWE

CWE-352

References

https://github.com/gunet/openeclass/security/advisories/GHSA-cgmh-73qg-28fm

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.