Open edX Platform’s /api/support/v1/manage_course_team/ endpoint, designed for support staff, fails to enforce the required support‑role permission. Because the endpoint accepts any authenticated user, it returns 200 for valid accounts and 404 for non‑existent ones, enabling attackers to discover user identities. Additionally, users with course or organization instructor roles can retrieve staff or instructor assignments for the target user within the caller’s scope. This vulnerability permits account enumeration and the exposure of staff roles to any authenticated learner, potentially facilitating social engineering or insider threat activities.

Vendors: Open edX Platform (openedx:openedx-platform). Affected product: Open edX Platform releases from the Ulmo series up through release/ulmo.4 and release/verawood.1 inclusive. Versions lacking the fix are any releases prior to ulmo.4 or verawood.1 where the GET /api/support/v1/manage_course_team/ endpoint does not include the global support‑role authorization gate.

The CVSS score of 5.3 indicates medium severity, while the EPSS score is not available, suggesting limited publicly observed exploitation. The vulnerability is not listed in the CISA KEV catalog. Attackers require an authenticated session, so the attack vector is authenticated. A legitimate learner or instructor can trigger the API, enumerate account existence, and, if possessing instructor privileges, learn staff assignments. Because the endpoint is exposed to all authenticated users, the risk is extended to anyone with login credentials, but the impact is limited to information disclosure and potential for malicious social engineering rather than code execution or system compromise.