CVE-2026-24774: Open eClass Auth Bypass Vulnerability

CVE-2026-24774 Overview

A business logic vulnerability has been identified in the Open eClass platform (formerly known as GUnet eClass), a complete course management system used by educational institutions. Prior to version 4.2, authenticated students can improperly mark themselves as present in attendance activities by directly accessing a crafted URL. This includes the ability to manipulate attendance records for activities that have already expired, undermining the integrity of academic attendance tracking.

Critical Impact

Authenticated students can falsify attendance records by bypassing normal workflow controls, including marking attendance for expired activities through direct URL manipulation.

Affected Products

• Open eClass platform versions prior to 4.2
• GUnet eClass (former product name) versions prior to 4.2

Discovery Timeline

• 2026-02-03 - CVE-2026-24774 published to NVD
• 2026-02-04 - Last updated in NVD database

Technical Details for CVE-2026-24774

Vulnerability Analysis

This vulnerability falls under CWE-841 (Improper Enforcement of Behavioral Workflow), a business logic flaw that allows users to bypass the intended application workflow. The Open eClass platform fails to properly validate the state and timing constraints of attendance activities when processing attendance marking requests.

The vulnerability exists because the application does not adequately verify whether an attendance activity is currently active before accepting student attendance submissions. Additionally, authorization checks on the attendance marking endpoint are insufficient, allowing students to directly invoke the attendance recording functionality without going through the proper user interface flow.

Root Cause

The root cause is improper enforcement of behavioral workflow in the attendance management module. The application relies on client-side controls or UI-level restrictions to prevent students from marking attendance for inactive or expired activities, rather than implementing robust server-side validation. This architectural weakness allows direct URL access to bypass temporal and authorization constraints that should govern attendance recording.

Attack Vector

The attack is network-based and requires low privileges (authenticated student account). An attacker with valid student credentials can craft a specific URL that directly invokes the attendance marking functionality, bypassing the normal user interface workflow. By manipulating parameters in this crafted URL, the attacker can mark themselves present in attendance activities regardless of whether those activities are currently active, have already expired, or are otherwise restricted.

The exploitation requires no user interaction beyond the attacker's own actions, and the attack complexity is low since it only requires knowledge of the URL structure and parameter manipulation.

Detection Methods for CVE-2026-24774

Indicators of Compromise

• Attendance records showing students marked present for activities that were expired at the time of submission
• Direct HTTP requests to attendance marking endpoints without corresponding UI session activity
• Unusual patterns of attendance markings occurring outside of scheduled activity windows
• Server logs showing direct access to attendance recording URLs with manipulated parameters

Detection Strategies

• Implement logging and alerting for attendance submissions that occur outside of valid activity time windows
• Monitor for direct API/URL access patterns to attendance endpoints that bypass normal navigation flows
• Correlate attendance marking timestamps with activity scheduling data to identify temporal anomalies
• Review access logs for requests to attendance endpoints with unusual parameter combinations

Monitoring Recommendations

• Enable detailed request logging for all attendance-related endpoints in the Open eClass application
• Set up alerts for attendance modifications to expired or inactive activities
• Implement audit trails that capture the full request context including referrer headers and session state
• Consider implementing anomaly detection for unusual attendance submission patterns

How to Mitigate CVE-2026-24774

Immediate Actions Required

• Upgrade Open eClass platform to version 4.2 or later immediately
• Audit existing attendance records for potential manipulation, particularly for expired activities
• Review and validate attendance data integrity for academic terms prior to the upgrade
• Implement additional access controls at the web application firewall level if immediate patching is not possible

Patch Information

This vulnerability has been patched in Open eClass version 4.2. Organizations should upgrade to this version or later to remediate the vulnerability. For detailed patch information and release notes, refer to the GitHub Security Advisory.

Workarounds

• Restrict direct URL access to attendance marking endpoints using web server or WAF rules
• Implement additional server-side validation to check activity status before accepting attendance submissions
• Consider temporarily disabling the self-service attendance marking feature until the patch can be applied
• Monitor attendance logs closely for suspicious activity patterns during the remediation window

# Example: Apache mod_rewrite rule to restrict direct access to attendance endpoints
# Add to .htaccess or Apache configuration (temporary mitigation)
RewriteEngine On
RewriteCond %{HTTP_REFERER} !^https?://(www\.)?yourdomain\.edu [NC]
RewriteRule ^modules/attendance/.*$ - [F,L]