Medium severity · published Oct 8, 2025
CVE-2025-61906
Opencast's editor accidentally publishes videos/overwrites publications #1626
4.3
CVSS
0.3%
EPSS
No
On KEV
Description
Opencast is a free, open-source platform to support the management of educational audio and video content. Prior to Opencast 17.8 and 18.2, in some situations, Opencast's editor may publish a video without notifying the user. This may lead to users accidentally publishing media not meant for publishing, and thus possibly exposing internal media. This risk of this actually impacting someone is very low, though. This can only be triggered by users with write access to an event. They also have to use the editor, which is usually an action taken if they want to publish media and not something users would use on internal media they do not want to publish. Finally, they have to first click on "Save & Publish" before then selecting the "Save" option. Nevertheless, while very unlikely, this can happen. This issue is fixed in Opencast 17.8 and 18.2.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 22% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OP
opencast · opencast
< 17.8; >= 18.0, < 18.2 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-61906
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-61906
Patch
https://github.com/opencast/opencast-editor/commit/98ba1934f08f623f1537a9675cc452d803766a91
Exploit
https://github.com/opencast/opencast-editor/issues/1626
Vendor Advisory
https://github.com/opencast/opencast/security/advisories/GHSA-x6vw-p693-jjhv
More from opencast
8.8
CVE-2026-77614
Opencast: Session fixation in login enables account takeover via crafted link
8.8
CVE-2017-1000217
Opencast 2.3.2 and older versions are vulnerable to script injections through media and metadata in the player and media module resulting in arbitrary code execution, fixed in…
8.7
CVE-2026-77615
Paella Player: Stored XSS via caption cue text
6.5
CVE-2025-54380
Opencast still publishes global system account credentials
5.4
CVE-2025-61788
Opencast Paella Player 7 vulnerable to Cross-Site-Scripting
