-1.png?width=100&height=75&name=Edly%20by%20Arbisoft%20(Red%20and%20Gray)-1.png)
Understanding Open edX Security Reports and Documentation
What should be documented about Open edX security reports?
The findings documented here — covering user visibility, endpoint access, and course enrollment behavior — are confirmed as intentional platform design or configuration-driven behavior, not vulnerabilities requiring platform code changes. The sections below explain each finding directly.
How does authenticated user enumeration work?
Authenticated user enumeration can occur when a logged-in user accesses the user account endpoint and sees different responses depending on whether a username exists. The user profile page is also publicly visible by default at the /u/{username} URL, and usernames and profile images are visible on that page.
This visibility is an intentional Open edX design feature used to support community interaction, including discussion forum context. Learners control what additional personal data is visible to others by choosing between the Limited Profile and Full Profile settings in their account.
Are admin and Swagger endpoints exposed publicly?
Admin and Swagger endpoints were confirmed to be accessible only through an internal VPN. When accessed externally, they correctly return a 403 Forbidden response.
Why might a user be able to enroll in a future course?
A user may be able to enroll in a future course because of the course author's configuration. This behavior is configuration-driven rather than a platform security issue.
What should be done when reviewing similar findings?
When reviewing security findings in Open edX, first determine whether the behavior is a known non-vulnerability by checking each of the following criteria:
- An intentional platform design feature
- Protected by access controls such as VPN restrictions
- Caused by course-level configuration
If the behavior falls into any of these categories, mark the finding as informational or expected behavior and document which category applies. If the behavior does not fit any category, escalate it as a potential platform security issue for further investigation.
What is the overall conclusion for these Open edX findings?
Each finding reviewed falls into one of three categories: intentional platform design behavior, secure endpoint handling enforced by VPN access controls, or course-level configuration choices made by the course author. No platform code changes are required.