CVE-2026-42163CWE-284broken-access-control

CVE-2026-42163

Critical · published August 18, 2026

CVSS v3.1
9.8
EPSS
0%
Percentile
40.6
In the wild
Unconfirmed
What it is

Mahara before 25.04.5 and 26.04.0 is vulnerable to unauthorized access to internal accounts via Learning Tools Interoperability (LTI) under certain circumstances. This applies to LTI 1.1 and LTI 1.3 Advantage.

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00483 · 40.6th percentile
Weakness
CWE-284 · Improper Access Control
Published
2026-08-18T02:17Z
References (1)
https://mahara.org/interaction/forum/topic.php?id=10077 · [email protected]
EPSS history
Timeline
  • 17 AUG 00:00Z
    Mahara before 25.04.5 and 26.04.0 is vulnerable to unauthorized access to internal accounts via Learning Tools Interoperability (LTI) under certain…
    cvelistv5