Critical · published August 26, 2025
🚨 An administrator could peek into sensitive information they shouldn't see just through the 'Current submissions' page! 🔥 Imagine a teacher who stumbles upon an open locker filled with confidential student reports, just because they happened to be passing by — that's what this vulnerability allows for! An attacker with admin access could view sensitive submissions from users, potentially exposing private information. This could lead to a breach of trust within the institution, as users may unknowingly have their data disclosed to unauthorized eyes.
Imagine a teacher who stumbles upon an open locker filled with confidential student reports, just because they happened to be passing by — that's what this vulnerability allows for! This vulnerability arises in Mahara versions 24.04 before 24.04.1 and 23.04 before 23.04.6, where specific conditions on the 'Current submissions' page allow for unintended information disclosure to administrators.
An attacker with admin access could view sensitive submissions from users, potentially exposing private information. This could lead to a breach of trust within the institution, as users may unknowingly have their data disclosed to unauthorized eyes. Upgrade to Mahara version 24.04.1 or 23.04.6 immediately to patch this vulnerability. Review your administrative privileges to ensure that sensitive data is adequately protected. Regular audits are always a smart move! You've got this! Patch up, secure your data, and keep your institution safe. 🛡️