Understanding Open edX Security Reports and Documentation

What should be documented about Open edX security reports?

Open edX security reports can include findings about user visibility, endpoint access, and course enrollment behavior. The items reviewed here were confirmed as intentional platform behavior or configuration-driven behavior rather than platform code changes.

How does authenticated user enumeration work?

Authenticated user enumeration can occur when a logged-in user accesses the user account endpoint and sees different responses depending on whether a username exists. The user profile page is also publicly visible by default at the /u/{username} URL, and usernames and profile images are visible on that page.

This visibility is an intentional Open edX design feature used to support community interaction, including discussion forum context. Learners control other personal data through the Limited Profile and Full Profile settings.

Are admin and Swagger endpoints exposed publicly?

Admin and Swagger endpoints were confirmed to be accessible only through an internal VPN. When accessed externally, they correctly return a 403 Forbidden response.

Why might a user be able to enroll in a future course?

A user may be able to enroll in a future course because of the course author's configuration. This behavior is configuration-driven rather than a platform security issue.

What should be done when reviewing similar findings?

When reviewing security findings in Open edX, check whether the behavior is:

1. An intentional platform design feature
2. Protected by access controls such as VPN restrictions
3. Caused by course-level configuration

Summary

The reviewed Open edX findings were identified as intentional behavior, secure endpoint handling, or course configuration behavior.