CVE-2026-42860 - Vulnerability Analysis
HighCVSS: 8.5Last Updated: May 12, 2026
Open edX Enterprise Service - Server Side Request Forgery
Overview
Open edX Enterprise Service 7.0.2 to 7.0.4 contains a server-side request forgery caused by unsanitized URL input in sync_provider_data endpoint, letting authenticated Enterprise Admins trigger arbitrary HTTP requests, exploit requires Enterprise Admin role.
Severity & Score
Impact
Authenticated Enterprise Admins can make arbitrary server-side HTTP requests, potentially accessing internal resources or causing denial of service.
Mitigation
Upgrade to version 7.0.5 or later.
Social Media Activity(2 posts)
š CVE-2026-42860 - High (8.5) The Open edx Enterprise Service app provides enterprise features to the Open edX platform. From 7.0.2 to 7.0.4, the sync_provider_data endpoint in SAMLProviderDataViewSet fetches SAML metadata from a URL stored in SAMLProviderConfig.metadata_sourc... š https://www.thehackerwire.com/vulnerability/CVE-2026-42860/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
View original post
š CVE-2026-42860 - High (8.5) The Open edx Enterprise Service app provides enterprise features to the Open edX platform. From 7.0.2 to 7.0.4, the sync_provider_data endpoint in SAMLProviderDataViewSet fetches SAML metadata from a URL stored in SAMLProviderConfig.metadata_sourc... š https://www.thehackerwire.com/vulnerability/CVE-2026-42860/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
View original postRelated Resources
Details
- CVE ID
- CVE-2026-42860
- Severity
- High
- CVSS Score
- 8.5
- Type
- server_side_request_forgery
- Status
- unconfirmed
- EPSS
- 2.8%
- Social Posts
- 2
CWE
- CWE-918
CVSS Metrics
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N