The vulnerability resides in the Open edX Platform view function set_course_mode_price, which is only protected by a login requirement and lacks any course‑level permission checks. Consequently, any authenticated user—regardless of role—can send a POST request to overwrite the honor mode price and currency for any course on the platform. This flaw permits an attacker to alter course pricing, potentially undermining revenue streams and misrepresenting course offerings. The weakness is a classic missing authorization flaw (CWE‑862).

The affected product is the Open edX Platform provided by openedx. Any deployment that has not incorporated the security patch introduced in commit 59bb6d6 (and subsequent commits) is vulnerable. The patch specifically targets the set_course_mode_price endpoint and restores proper permission checks.

The CVSS score of 7.6 indicates a high severity. While the EPSS score is not available, the lack of an authorization check means the vulnerability can be exploited by any logged‑in user, making it trivially exploitable without advanced skills. The vulnerability is not listed in the CISA KEV catalog, but its potential to alter financial information warrants immediate attention. The likely attack vector is remote authenticated, as an adversary may use valid credentials or hijack a legitimate learner account to issue the unauthorized request.