{"id":"CVE-2020-5231","aliases":["EUVD-2020-0261","GHSA-94qw-r73x-j7hg"],"status":"published","title":"Opencast users with ROLE_COURSE_ADMIN can create new users","description":"In Opencast before 7.6 and 8.1, users with the role ROLE_COURSE_ADMIN can use the user-utils endpoint to create new users not including the role ROLE_ADMIN. ROLE_COURSE_ADMIN is a non-standard role in Opencast which is referenced neither in the documentation nor in any code (except for tests) but only in the security configuration. From the name – implying an admin for a specific course – users would never expect that this role allows user creation. This issue is fixed in 7.6 and 8.1 which both ship a new default security configuration.","severity":{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00625,"percentile":0.50265,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-276","CWE-285"],"published":"2020-01-30T21:15:16Z","modified":"2026-10-20T10:54:22Z","fixes":[{"ecosystem":"Maven","package":"org.opencastproject:opencast-kernel","fixed_in":["7.6","8.1"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.opencastproject:opencast-kernel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.6"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.opencastproject:opencast-kernel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.0"},{"fixed":"8.1"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.opencastproject:opencast-kernel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.6"}]}],"versions":["6.6","7.2","7.3","7.4","7.5"]},{"source":"osv","ecosystem":"Maven","package":"org.opencastproject:opencast-kernel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.0"},{"fixed":"8.1"}]}],"versions":["8.0"]}],"products":[{"vendor":"apereo","product":"opencast"},{"vendor":"opencast","product":"opencast"}],"references":[{"url":"https://github.com/opencast/opencast/security/advisories/GHSA-94qw-r73x-j7hg","tags":["x_refsource_CONFIRM","x_transferred","Exploit","Third Party Advisory","evidence","web"]},{"url":"https://github.com/opencast/opencast/commit/72fad0031d8a82c860e2bde0b27570c5042320ee","tags":["x_refsource_MISC","x_transferred","Patch","fix","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-5231","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-94qw-r73x-j7hg"}],"sources":{"cve":[{"id":"CVE-2020-5231","title":"Opencast users with ROLE_COURSE_ADMIN can create new users","description":"In Opencast before 7.6 and 8.1, users with the role ROLE_COURSE_ADMIN can use the user-utils endpoint to create new users not including the role ROLE_ADMIN. ROLE_COURSE_ADMIN is a non-standard role in Opencast which is referenced neither in the documentation nor in any code (except for tests) but only in the security configuration. From the name – implying an admin for a specific course – users would never expect that this role allows user creation. This issue is fixed in 7.6 and 8.1 which both ship a new default security configuration.","status":"published","published":"2020-01-30T21:15:16Z","modified":"2024-08-04T08:22:08.962Z","cvss":[{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-285"],"updated_at":"2026-11-02T14:35:47.877975Z"}],"euvd":[{"id":"EUVD-2020-0261","description":"In Opencast before 7.6 and 8.1, users with the role ROLE_COURSE_ADMIN can use the user-utils endpoint to create new users not including the role ROLE_ADMIN. ROLE_COURSE_ADMIN is a non-standard role in Opencast which is referenced neither in the documentation nor in any code (except for tests) but only in the security configuration. From the name – implying an admin for a specific course – users would never expect that this role allows user creation. This issue is fixed in 7.6 and 8.1 which both ship a new default security configuration.","status":"published","published":"2020-01-30T21:15:16Z","modified":"2024-08-04T08:22:08Z","cvss":[{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-03T03:08:07.872525Z"}],"ghsa":[{"id":"GHSA-94qw-r73x-j7hg","title":"Users with ROLE_COURSE_ADMIN can create new users in Opencast","description":"### Impact\n\nUsers with the role `ROLE_COURSE_ADMIN` can use the user-utils endpoint to create new users not including the role `ROLE_ADMIN`. For example:\n\n```bash\n# Use the admin to create a new user with ROLE_COURSE_ADMIN using the admin user.\n# We expect this to work.\n% curl -i -u admin:opencast 'https://example.opencast.org/user-utils/xy.json' -X PUT \\\n  --data 'password=f\u0026roles=%5B%22ROLE_COURSE_ADMIN%22%5D'\nHTTP/2 201\n\n# Use the new user to create more new users.\n# We don't expüect a user with just role ROLE_COURSE_ADMIN to succeed.\n# But it does work\n% curl -i -u xy:f 'https://example.opencast.org/user-utils/ab.json' -X PUT \\\n  --data 'password=f\u0026roles=%5B%22ROLE_COURSE_ADMIN%22%5D'\nHTTP/2 201\n```\n`ROLE_COURSE_ADMIN` is a non-standard role in Opencast which is referenced neither in the documentation nor in any code (except for tests) but only in the security configuration. From the name – implying an admin for a specific course – users would never expect that this role allows user creation.\n\n### Patches\n\nThis issue is fixed in 7.6 and 8.1 which both ship a new default security configuration.\n\n### Workarounds\n\nYou can fix this issue by removing all instances of `ROLE_COURSE_ADMIN` in your organization's security configuration (`etc/security/mh_default_org.xml` by default).\n\n### For more information\n\nIf you have any questions or comments about this advisory:\n\n- Open an issue in [opencast/opencast](https://github.com/opencast/opencast/issues)\n- For security-relevant information, email us at security@opencast.org","status":"published","published":"2020-01-30T21:21:37Z","modified":"2023-01-09T05:02:08Z","cvss":[{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-285"],"updated_at":"2026-11-02T14:36:03.040255Z"}],"nvd":[{"id":"CVE-2020-5231","description":"In Opencast before 7.6 and 8.1, users with the role ROLE_COURSE_ADMIN can use the user-utils endpoint to create new users not including the role ROLE_ADMIN. ROLE_COURSE_ADMIN is a non-standard role in Opencast which is referenced neither in the documentation nor in any code (except for tests) but only in the security configuration. From the name – implying an admin for a specific course – users would never expect that this role allows user creation. This issue is fixed in 7.6 and 8.1 which both ship a new default security configuration.","status":"published","published":"2020-01-30T22:15:10.22Z","modified":"2026-06-17T03:21:04.517Z","cvss":[{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"secondary"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":4,"vector":"AV:N/AC:L/Au:S/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-285","CWE-276"],"updated_at":"2026-11-02T14:05:53.837808Z"}],"osv":[{"id":"CVE-2020-5231","description":"In Opencast before 7.6 and 8.1, users with the role ROLE_COURSE_ADMIN can use the user-utils endpoint to create new users not including the role ROLE_ADMIN. ROLE_COURSE_ADMIN is a non-standard role in Opencast which is referenced neither in the documentation nor in any code (except for tests) but only in the security configuration. From the name – implying an admin for a specific course – users would never expect that this role allows user creation. This issue is fixed in 7.6 and 8.1 which both ship a new default security configuration.","status":"published","published":"2020-01-30T22:15:10.22Z","modified":"2026-10-20T10:54:22.263906127Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:16.936975Z"},{"id":"GHSA-94qw-r73x-j7hg","title":"Users with ROLE_COURSE_ADMIN can create new users in Opencast","description":"### Impact\n\nUsers with the role `ROLE_COURSE_ADMIN` can use the user-utils endpoint to create new users not including the role `ROLE_ADMIN`. For example:\n\n```bash\n# Use the admin to create a new user with ROLE_COURSE_ADMIN using the admin user.\n# We expect this to work.\n% curl -i -u admin:opencast 'https://example.opencast.org/user-utils/xy.json' -X PUT \\\n  --data 'password=f\u0026roles=%5B%22ROLE_COURSE_ADMIN%22%5D'\nHTTP/2 201\n\n# Use the new user to create more new users.\n# We don't expüect a user with just role ROLE_COURSE_ADMIN to succeed.\n# But it does work\n% curl -i -u xy:f 'https://example.opencast.org/user-utils/ab.json' -X PUT \\\n  --data 'password=f\u0026roles=%5B%22ROLE_COURSE_ADMIN%22%5D'\nHTTP/2 201\n```\n`ROLE_COURSE_ADMIN` is a non-standard role in Opencast which is referenced neither in the documentation nor in any code (except for tests) but only in the security configuration. From the name – implying an admin for a specific course – users would never expect that this role allows user creation.\n\n### Patches\n\nThis issue is fixed in 7.6 and 8.1 which both ship a new default security configuration.\n\n### Workarounds\n\nYou can fix this issue by removing all instances of `ROLE_COURSE_ADMIN` in your organization's security configuration (`etc/security/mh_default_org.xml` by default).\n\n### For more information\n\nIf you have any questions or comments about this advisory:\n\n- Open an issue in [opencast/opencast](https://github.com/opencast/opencast/issues)\n- For security-relevant information, email us at security@opencast.org","status":"published","published":"2020-01-30T21:21:37Z","modified":"2026-09-10T03:48:42.029744564Z","cvss":[{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-285"],"updated_at":"2026-11-02T15:46:43.123867Z"}]}}