Description
A flaw was found in Moodle. Insufficient access control checks on H5P content files allow unauthenticated remote attackers to view restricted materials, including content stored in the system context and files belonging to hidden or unavailable course modules. This issue results in unauthorized information disclosure of protected content.
Published: 2026-11-06
Score: 7.5 High
EPSS: n/a
KEV: No
Impact: Unauthorized Information Disclosure
Action: Apply Patch
AI Analysis

Impact

The flaw arises from inadequate access control on H5P content files in Moodle. Unauthenticated remote users can request these files, including those stored in system context or belonging to hidden or unavailable course modules. The result is the disclosure of protected material, classified as an instance of CWE-862.

Affected Systems

Moodle installations that support H5P content are potentially affected. No specific version data is provided, so all Moodle environments with H5P enabled must be considered at risk until a patch is applied.

Risk and Exploitability

The CVSS score of 7.5 indicates high severity, yet no EPSS data is available and the vulnerability is not listed in the CISA KEV catalog. Attackers do not need authentication; a simple HTTP request to the file path or an exposed download endpoint can trigger disclosure. Without a patch or configuration fix, the risk remains present.

Generated by OpenCVE AI on November 6, 2026 at 14:06 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update Moodle to the latest version that includes the fixed H5P access checks.
  • Configure the Moodle file server to serve H5P content only through authenticated sessions, ensuring that the internal file service acts as a gatekeeper.
  • Review and enforce role‑based permissions for course modules and hidden resources so that users cannot access files belonging to unavailable or hidden modules.
  • Audit file system permissions to confirm that H5P content files are not directly web‑accessible outside Moodle's file handling mechanisms.

Generated by OpenCVE AI on November 6, 2026 at 14:06 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 06 Nov 2026 14:00:00 +0000

Type Values Removed Values Added
First Time appeared Moodle
Moodle moodle
Vendors & Products Moodle
Moodle moodle

Fri, 06 Nov 2026 12:00:00 +0000

Type Values Removed Values Added
Description A flaw was found in Moodle. Insufficient access control checks on H5P content files allow unauthenticated remote attackers to view restricted materials, including content stored in the system context and files belonging to hidden or unavailable course modules. This issue results in unauthorized information disclosure of protected content.
Title Moodle: missing access checks on h5p content files
Weaknesses CWE-862
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'}

Subscriptions

Moodle Moodle
cve-icon MITRE

Status: PUBLISHED

Assigner: fedora

Published:

Updated: 2026-11-06T14:45:54.762Z

Reserved: 2026-11-06T08:49:59.128Z

Link: CVE-2026-123655

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-11-06T12:17:20.657

Modified: 2026-11-06T15:17:20.273

Link: CVE-2026-123655

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-11-06T14:15:04Z

Weaknesses