The vulnerability is a broken access control that allows authenticated students to create new course units, a function normally restricted to higher‑privileged roles. This enables students to add or modify instructional units, potentially injecting unauthorized content or altering course structure. The flaw aligns with CWE‑284, providing unauthorized elevation of privileges within the platform.

Affected systems are the Open eClass platform (formerly GUnet eClass) distributed by gunet. All versions earlier than 4.2 are vulnerable. The issue was fixed in release 4.2, which revokes the students' ability to create units.

The CVSS score of 6.5 indicates a moderate risk, and an EPSS of less than 1% suggests a low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires an authenticated student session; therefore the threat is constrained to users who can obtain or compromise legitimate login credentials. No network‑level attack vector is needed, limiting risk to environments where student accounts or credentials are exposed.