Prior to version 4.2 of the Open eClass platform, a broken access control flaw let authenticated students add new content to course units that should have been restricted to instructors or administrators. This unauthorized privilege enables students to upload or publish slides, documents, or other learning materials, undermining the integrity of the course content. The flaw is classified as CWE-284, indicating incorrect or missing access control enforcement.

The vulnerability is present in Open eClass platforms developed by gunet:openeclass. Versions earlier than 4.2 are impacted. Administrators should verify the platform version in use, and any custom deployments that inherit the same access control logic, as they may also expose the same issue.

The CVSS score of 6.5 indicates a moderate severity, while the EPSS score of less than 1% suggests a low exploitation likelihood. The vulnerability is not listed in the CISA KEV catalog. Nevertheless, authenticated users can insert arbitrary content, potentially spreading misinformation or inappropriate material. The attack vector is through the web interface used by logged‑in students; no additional privileges or code execution are required.