CVE-2026-97702

The Open edX Platform is vulnerable to an authorization bypass in the CourseTeamManageAPIView component (from the Ulmo release until release/ulmo.4 and release/verawood.1 ). The GET /api/support/v1/manage_course_team/ endpoint omits the mandatory support-role check, requiring only IsAuthenticated...