{"action":"Upgrade edx-enterprise to 7.0.5 or later.","affected":[{"fixed":"7.0.5","introduced":"7.0.2"}],"component":"edx-enterprise","cve_ids":["CVE-2026-42860"],"ecosystem":"PyPI","epss":0.00301,"exploited":false,"fixed_versions":["7.0.5"],"ghsa_id":"GHSA-64cv-vxpr-j6vc","id":"tcs_01M5KHC8EEEDKFP0286YE9E7VH","modified_at":"2026-05-20T09:18:59.782659Z","published_at":"2026-05-11T18:16:36.547Z","references":["https://osv.dev/vulnerability/PYSEC-2026-58","https://github.com/openedx/edx-enterprise/security/advisories/GHSA-64cv-vxpr-j6vc"],"severity":{"label":"high","score":8.5},"sources":[{"source":"osv","source_id":"PYSEC-2026-58","url":"https://osv.dev/vulnerability/PYSEC-2026-58"}],"summary":"The Open edx Enterprise Service app provides enterprise features to the Open edX platform. From 7.0.2 to 7.0.4, the sync_provider_data endpoint in SAMLProviderDataViewSet fetches SAML metadata from a"}