CVE-2025-61906: Apereo Opencast Information Disclosure Flaw

CVE-2025-61906 Overview

Apereo Opencast is an open-source platform for managing educational audio and video content. CVE-2025-61906 affects the Opencast editor prior to versions 17.8 and 18.2. Under specific interaction sequences, the editor can publish a video without notifying the user. This may result in internal media being exposed unintentionally.

The issue is classified as an information exposure weakness [CWE-200]. Exploitation is limited to authenticated users with write access to an event who use the editor and click Save & Publish before selecting Save. The vendor characterizes the real-world likelihood as low, and no exploit is publicly available.

Critical Impact
Authenticated users of the Opencast editor may unintentionally publish internal media, exposing content that was not intended for public release.

Affected Products

Apereo Opencast versions prior to 17.8
Apereo Opencast versions prior to 18.2 in the 18.x branch
Opencast Editor component (opencast-editor)

Discovery Timeline

2025-10-08 - CVE-2025-61906 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-61906

Vulnerability Analysis

The flaw resides in the Opencast Editor front-end, specifically in the save and workflow-selection user interface flow. The SaveButton component did not distinguish between saving edits and saving with workflow execution (publication). When a user initiated the Save & Publish action and then subsequently chose the Save option, the interface could still trigger the publishing workflow without a confirmation prompt.

This is a business logic and user interface confusion defect rather than a memory or injection issue. The consequence is unintended disclosure of media assets that administrators or content owners intended to keep internal. Because triggering the condition requires an authenticated editor session with write access to an event, the scope of exposure is bounded to users already trusted to modify the affected content.

Root Cause

The SaveButton React component lacked an explicit parameter to indicate whether a save action should also start a publication workflow. The default behavior on certain code paths in WorkflowSelection.tsx invoked the workflow regardless of the user's final selection. The absence of a startWorkflow flag caused the editor to conflate the save-only path with the save-and-publish path.

Attack Vector

Exploitation is not remote or unauthenticated. A user with write access to an event opens the editor, clicks Save & Publish, and then selects Save. The editor may then publish the media without further notification, exposing content over the network to any user or system authorized to view published Opencast media.

tsx

// Patch: src/main/Save.tsx - adds explicit startWorkflow flag
 export const SaveButton: React.FC<{
   text?: string
   isTransitionToEnd?: boolean
+  startWorkflow?: boolean
 }> = ({
   text,
   isTransitionToEnd = false,
+  startWorkflow = false,
 }) => {
   const { t } = useTranslation();

// Patch: src/main/WorkflowSelection.tsx - only start workflow when intended
           <SaveButton
             isTransitionToEnd={true}
             text={t("workflowSelection.startProcessing-button")}
+            startWorkflow={true}
           />,
           saveStatus,
           saveError,

Source: Opencast Editor commit 98ba1934

Detection Methods for CVE-2025-61906

Indicators of Compromise

Opencast events transitioning to a published state without a corresponding user-confirmed publish action in application logs.
Media assets appearing on public distribution channels shortly after editor Save events triggered by authenticated users.
Workflow execution records for publication workflows initiated immediately after Save & Publish interactions that were not fully confirmed.

Detection Strategies

Audit the Opencast workflow service history for publish workflows executed against events flagged as internal or restricted.
Correlate editor session activity with workflow instances to identify save operations that unexpectedly triggered publication.
Review access control changes on media packages to detect events that shifted from internal to public visibility without administrative review.

Monitoring Recommendations

Enable detailed logging on the Opencast REST endpoints handling workflow start requests and editor save operations.
Alert on any publication workflow initiated on events tagged with internal-only metadata.
Track editor version strings in HTTP request headers to identify clients running vulnerable opencast-editor builds.

How to Mitigate CVE-2025-61906

Immediate Actions Required

Upgrade Apereo Opencast to version 17.8 or 18.2 or later, which contain the corrected SaveButton logic.
Review recently published media in production Opencast deployments and unpublish any content that was not intended for release.
Audit user roles to confirm that write access to events is granted only to users who require it.

Patch Information

The fix is delivered in Opencast 17.8 and 18.2. The corrective change is tracked in the opencast-editor repository in commit 98ba1934f08f623f1537a9675cc452d803766a91 and documented in the GitHub Security Advisory GHSA-x6vw-p693-jjhv. Additional technical context is available in GitHub Issue #1626.

Workarounds

Restrict editor access to a smaller set of trusted users until patched versions are deployed.
Instruct editor users to complete the intended Save & Publish workflow rather than switching to Save mid-flow.
Configure publication workflows to require an additional review step or approval before media becomes publicly accessible.

bash

# Verify installed Opencast version and upgrade path
curl -s -u admin:$OC_ADMIN_PASS https://opencast.example.org/sysinfo/bundles/version | jq '.version'

# Example upgrade using the official distribution
wget https://github.com/opencast/opencast/releases/download/18.2/opencast-dist-allinone-18.2.tar.gz
tar -xzf opencast-dist-allinone-18.2.tar.gz
systemctl stop opencast
rsync -a opencast-dist-allinone-18.2/ /opt/opencast/
systemctl start opencast