CVE-2026-123655

    Dashboard / Vulnerabilities / CVE-2026-123655

    CVE-2026-123655

    Published: 6 Nov 2026Last Modified: 8 Nov 2026

    Summary: Moodle: missing access checks on h5p content files

    Details: A flaw was found in Moodle. Insufficient access control checks on H5P content files allow unauthenticated remote attackers to view restricted materials, including content stored in the system context and files belonging to hidden or unavailable course modules. This issue results in unauthorized information disclosure of protected content.

    References: https://moodle.org/mod/forum/discuss.php?d=482830, https://access.redhat.com/security/cve/CVE-2026-123655, https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/123xxx/CVE-2026-123655.json, https://nvd.nist.gov/vuln/detail/CVE-2026-123655, https://bugzilla.redhat.com/show_bug.cgi?id=2568053, https://github.com/moodle/moodle/commit/4b42ce4ed1d132214fd4b7d4b5f4f0387ec28a49, https://github.com/moodle/moodle

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 52c0da7c647bd6ba8c5f61882d88959821a1fb41
    Fixed -215f44380bdc3ccf852a3a22e34f8423ff64033a

    Affected versions

    v5.3.0-rc1
    v5.3.0-beta

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2026-123655 | CVE-DB