The Open eClass platform suffers from a CSRF flaw affecting several teacher‑restricted API endpoints. An attacker can craft a malicious request that, when viewed by an authenticated teacher, triggers unintended operations such as changing assignment grades. The vulnerability is rooted in CWE‑352, allowing session hijacking through forged requests.

All Open eClass installations running a version earlier than 4.2 are vulnerable. This includes every deployment of the platform that has not yet incorporated the patch delivered in release 4.2.

The vulnerability carries a CVSS score of 6.5, indicating a moderate severity. The EPSS score is below 1 %, showing a low probability of exploitation in the wild, and the issue is not listed in CISA’s KEV catalog. Exploitation requires an attacker to get a teacher to load a crafted request, typically via phishing or a malicious web page, while their browser maintains an authenticated session. Given the lack of known active exploits and the low EPSS, the immediate risk is moderate but should be mitigated promptly to prevent potential credential‑reuse and data‑manipulation attacks.