CVE-2025-61906
📋 TL;DR
Opencast's editor may publish videos without user notification when users with write access click 'Save & Publish' then select 'Save' instead. This could accidentally expose internal media not intended for publication. Only affects Opencast users with event write access who use the editor interface.
💻 Affected Systems
- Opencast
📦 What is this software?
Opencast by Apereo
Opencast by Apereo
⚠️ Risk & Real-World Impact
Worst Case
Internal or sensitive media accidentally published to public audiences, potentially violating privacy or confidentiality requirements.
Likely Case
Low impact accidental publication of non-sensitive media due to the specific user actions required and typical editor usage patterns.
If Mitigated
Minimal impact with proper user training and access controls limiting editor usage to trusted personnel.
🎯 Exploit Status
Requires authenticated user with write permissions, specific editor usage, and specific button sequence ('Save & Publish' then 'Save').
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Opencast 17.8 or 18.2
Vendor Advisory: https://github.com/opencast/opencast/security/advisories/GHSA-x6vw-p693-jjhv
Restart Required: No
Instructions:
1. Upgrade Opencast to version 17.8 or 18.2. 2. No service restart required. 3. Verify editor functionality post-upgrade.
🔧 Temporary Workarounds
Editor Access Restriction
allLimit editor access to only trusted users who require publishing capabilities.
User Training
allTrain users to avoid clicking 'Save & Publish' unless intending to publish, and to use 'Save' only when not publishing.
🧯 If You Can't Patch
- Implement strict access controls limiting editor usage to essential personnel only.
- Monitor publishing logs for unusual activity and implement approval workflows for publications.
🔍 How to Verify
Check if Vulnerable:
Check Opencast version: if below 17.8 and not 18.2, system is vulnerable.Check Version:
Check Opencast admin interface or configuration files for version number.Verify Fix Applied:
Verify Opencast version is 17.8 or 18.2, then test editor functionality to ensure proper publish notifications.📡 Detection & Monitoring
Log Indicators:
- Unexpected publish events from editor interface
- Rapid sequence of save and publish actions
Network Indicators:
- Increased publishing traffic from editor users
SIEM Query:
Search for 'publish' events from editor interface without corresponding user confirmation logs.