CVE-2024-22209

Open edX Platform suffers an access-control vulnerability where a user with a JWT and limited scopes could call endpoints beyond their authorization. The issue concerns the XBlock custom auth not respecting JWT scopes, enabling elevation of privileges for certain API endpoints. Red Hat, NVD, and ...