Mahara installations that are older than versions 25.04.5 in the 25.x series or 26.04.0 in the 26.x series have a flaw that allows an attacker able to interact with the Learning Tools Interoperability (LTI) interfaces to gain unauthorized access to internal account information. The weakness arises when LTI 1.1 or LTI 1.3 Advantage is used under specific conditions, enabling the attacker to read or misuse account credentials that would normally be protected. This erodes user confidentiality and can lead to further compromise of the Mahara platform.

The affected product is the Mahara e‑learning platform. Only versions prior to 25.04.5 in the 25.x release line and prior to 26.04.0 in the 26.x release line are impacted. No additional vendor details are provided, so administrators must confirm the exact version of their Mahara deployment to determine whether they are vulnerable.

Based on the description, it is inferred that the attacker can trigger the vulnerability by sending an LTI request from an external network to the site, i.e., the attack vector is through the public network interface. The flaw can be exploited remotely by any user who can send an LTI request to the affected site. While CVSS and EPSS metrics are not published, the nature of the vulnerability—unauthorized account access—classifies it as high risk. The issue is not listed in the CISA KEV catalog, and no EPSS score exists, but administrators should still treat it as a significant threat until the platform is updated.